diff --git a/.github/workflows/test-template.yml b/.github/workflows/test-template.yml
index 2b7d665..4875889 100644
--- a/.github/workflows/test-template.yml
+++ b/.github/workflows/test-template.yml
@@ -107,10 +107,13 @@ jobs:
       - name: semgrep
         run: uvx semgrep@1.167.0 scan --config .semgrep.yml --metrics=off --error .
       # gitleaks is installed from the mise.toml pin (single source of truth);
-      # install: false brings up the mise CLI only.
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      # install: false brings up the mise CLI only. persist_github_token
+      # re-exports MISE_GITHUB_TOKEN (v5.1.1+ default is off) so the later
+      # `mise install`/`mise exec` calls api.github.com authenticated.
+      - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           install: false
+          persist_github_token: true
       - name: gitleaks
         run: |
           mise install gitleaks