diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 1e444d4..73ae0e5 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -65,3 +65,9 @@ Recovery can be rerun if it fails **before publication**. If either GitHub or Py
 already has the version, inspect that publication and finish the remaining work
 separately; the preflight will refuse another recovery run. Do not delete a
 publication merely to bypass this safeguard.
+
+The app-data caching step authenticates GitHub downloads using
+`FSSPEC_GITHUB_USERNAME` and `FSSPEC_GITHUB_TOKEN` with the caller's
+`general-token`. This avoids the shared runner IP's unauthenticated API quota.
+Using `GH_TOKEN` alone is insufficient for application versions that only read it
+while running tests.
diff --git a/.github/workflows/release-impl.yml b/.github/workflows/release-impl.yml
index b772602..be71ef6 100644
--- a/.github/workflows/release-impl.yml
+++ b/.github/workflows/release-impl.yml
@@ -438,6 +438,8 @@ jobs:
           poetry run "$EXE_NAME" manage cache-all
         env:
           EXE_NAME: ${{ inputs.executable_name }}
+          FSSPEC_GITHUB_USERNAME: x-access-token
+          FSSPEC_GITHUB_TOKEN: ${{ secrets.general-token }}
 
       - name: Upload all cached app data/programs
         id: upload-cached-app-data
diff --git a/scripts/test-release-recovery.sh b/scripts/test-release-recovery.sh
index 08450d6..80fe163 100644
--- a/scripts/test-release-recovery.sh
+++ b/scripts/test-release-recovery.sh
@@ -3,6 +3,14 @@ set -euo pipefail
 
 root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 workflow="$root/.github/workflows/release-impl.yml"
+cache_step=$(awk '
+  /^      - name: Cache all app data and programs$/ { found = 1; next }
+  found && /^      - name:/ { exit }
+  found { print }
+' "$workflow")
+grep -qF 'FSSPEC_GITHUB_USERNAME: x-access-token' <<< "$cache_step"
+grep -qF 'FSSPEC_GITHUB_TOKEN: ${{ secrets.general-token }}' <<< "$cache_step"
+printf 'PASS: app data caching configures authenticated fsspec GitHub access\n'
 tmp=$(mktemp -d)
 trap 'rm -r -- "$tmp"' EXIT