diff --git a/.github/workflows/push_subrepos.yml b/.github/workflows/push_subrepos.yml
index 250dcec2..b5262566 100644
--- a/.github/workflows/push_subrepos.yml
+++ b/.github/workflows/push_subrepos.yml
@@ -9,9 +9,9 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v2
-      with:
-        token: ${{ secrets.HEXOPS_MACH_PUSH_SUBREPOS }}
-    - name: 'gpu/dawn: use latest binary release'
+    - name: 'Push recent commits to subrepositories'
+      env:
+        ACCESS_TOKEN: ${{ secrets.HEXOPS_MACH_PUSH_SUBREPOS }}
       run: |
         git config user.name 'Repository synchronization automation'
         git config user.email 'stephen@hexops.com'
diff --git a/dev/update-subrepos.sh b/dev/update-subrepos.sh
index e5bb8c9f..c869b63d 100755
--- a/dev/update-subrepos.sh
+++ b/dev/update-subrepos.sh
@@ -2,12 +2,12 @@
 set -exuo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"/..
 
-if [[ -z "${GITHUB_ACTIONS}" ]]; then
+if [[ -z ${GITHUB_ACTIONS+""} ]]; then
     git remote add -f mach-glfw git@github.com:hexops/mach-glfw || true
     git remote add -f mach-gpu-dawn git@github.com:hexops/mach-gpu-dawn || true
 else
-    git remote add -f mach-glfw https://github.com/hexops/mach-glfw || true
-    git remote add -f mach-gpu-dawn https://github.com/hexops/mach-gpu-dawn || true
+    git remote add -f mach-glfw "https://slimsag:$ACCESS_TOKEN@github.com/hexops/mach-glfw" || true
+    git remote add -f mach-gpu-dawn "https://slimsag:$ACCESS_TOKEN@github.com/hexops/mach-gpu-dawn" || true
 fi
 
 git fetch mach-glfw