diff --git a/.github/workflows/dependabot-bun-dedupe.test.mjs b/.github/workflows/dependabot-bun-dedupe.test.mjs
new file mode 100644
index 0000000..917fbbe
--- /dev/null
+++ b/.github/workflows/dependabot-bun-dedupe.test.mjs
@@ -0,0 +1,23 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { test } from "node:test";
+
+const workflow = await readFile(
+  new URL("dependabot-bun-dedupe.yml", import.meta.url),
+  "utf8",
+);
+
+test("private fetch authorization is scoped to the autofix action process", () => {
+  assert.match(workflow, /persist-credentials: false/);
+  assert.match(workflow, /GH_TOKEN: \$\{\{ github\.token \}\}/);
+  assert.match(workflow, /echo "::add-mask::\$\{authorization\}"/);
+  assert.match(
+    workflow,
+    /GIT_CONFIG_KEY_0: http\.https:\/\/github\.com\/\.extraheader/,
+  );
+  assert.match(
+    workflow,
+    /GIT_CONFIG_VALUE_0: \$\{\{ env\.AUTOFIX_GIT_AUTHORIZATION \}\}/,
+  );
+  assert.doesNotMatch(workflow, /permissions:\n\s+contents: write/);
+});
diff --git a/.github/workflows/dependabot-bun-dedupe.yml b/.github/workflows/dependabot-bun-dedupe.yml
index bf0f2df..d8215cb 100644
--- a/.github/workflows/dependabot-bun-dedupe.yml
+++ b/.github/workflows/dependabot-bun-dedupe.yml
@@ -56,7 +56,22 @@ jobs:
 
           git diff --check -- bun.lock
 
+      - name: Prepare private-repository fetch authorization
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          authorization="$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\n')"
+          echo "::add-mask::${authorization}"
+          echo "AUTOFIX_GIT_AUTHORIZATION=AUTHORIZATION: basic ${authorization}" >> "$GITHUB_ENV"
+
       - name: Push dedupe fix
         uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4
+        env:
+          GIT_CONFIG_COUNT: "1"
+          GIT_CONFIG_KEY_0: http.https://github.com/.extraheader
+          GIT_CONFIG_VALUE_0: ${{ env.AUTOFIX_GIT_AUTHORIZATION }}
         with:
           commit-message: "chore: dedupe Bun lockfile"