diff --git a/.github/workflows/app-deploy-staging.yml b/.github/workflows/app-deploy-staging.yml
index f364b9560c..5bc7e1abb4 100644
--- a/.github/workflows/app-deploy-staging.yml
+++ b/.github/workflows/app-deploy-staging.yml
@@ -34,10 +34,20 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
         with:
-          # The encoder's player packages are consumed from luminary-media-convert/, which is
-          # a submodule rather than a published package. The submodule repository is
-          # public, so the built-in token suffices; no extra credential is needed.
+          # The encoder's player packages are consumed from luminary-media-convert/,
+          # which is a submodule rather than a published package.
+          #
+          # That repository is private, and a workflow's GITHUB_TOKEN reaches only the
+          # repository it runs in — a private sibling answers "Repository not found"
+          # and checkout aborts before any step runs. MEDIA_CONVERT_TOKEN is a
+          # credential with read access to it.
+          #
+          # The fallback matters: `actions/checkout` rejects an empty `token:`
+          # outright ("Input required and not supplied"), which would break this
+          # repository's own checkout while the secret is unset, rather than leaving
+          # only the submodule to fail.
           submodules: true
+          token: ${{ secrets.MEDIA_CONVERT_TOKEN || github.token }}
 
       - name: Create .env file
         run: |
diff --git a/.github/workflows/app-unit-tests.yml b/.github/workflows/app-unit-tests.yml
index 9eb385510c..67ebbe810e 100644
--- a/.github/workflows/app-unit-tests.yml
+++ b/.github/workflows/app-unit-tests.yml
@@ -23,10 +23,20 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
         with:
-          # The encoder's player packages are consumed from luminary-media-convert/, which is
-          # a submodule rather than a published package. The submodule repository is
-          # public, so the built-in token suffices; no extra credential is needed.
+          # The encoder's player packages are consumed from luminary-media-convert/,
+          # which is a submodule rather than a published package.
+          #
+          # That repository is private, and a workflow's GITHUB_TOKEN reaches only the
+          # repository it runs in — a private sibling answers "Repository not found"
+          # and checkout aborts before any step runs. MEDIA_CONVERT_TOKEN is a
+          # credential with read access to it.
+          #
+          # The fallback matters: `actions/checkout` rejects an empty `token:`
+          # outright ("Input required and not supplied"), which would break this
+          # repository's own checkout while the secret is unset, rather than leaving
+          # only the submodule to fail.
           submodules: true
+          token: ${{ secrets.MEDIA_CONVERT_TOKEN || github.token }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
diff --git a/.github/workflows/cms-deploy-staging.yml b/.github/workflows/cms-deploy-staging.yml
index 51ff4bc67d..9580e5fca6 100644
--- a/.github/workflows/cms-deploy-staging.yml
+++ b/.github/workflows/cms-deploy-staging.yml
@@ -34,10 +34,20 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
         with:
-          # The encoder's player packages are consumed from luminary-media-convert/, which is
-          # a submodule rather than a published package. The submodule repository is
-          # public, so the built-in token suffices; no extra credential is needed.
+          # The encoder's player packages are consumed from luminary-media-convert/,
+          # which is a submodule rather than a published package.
+          #
+          # That repository is private, and a workflow's GITHUB_TOKEN reaches only the
+          # repository it runs in — a private sibling answers "Repository not found"
+          # and checkout aborts before any step runs. MEDIA_CONVERT_TOKEN is a
+          # credential with read access to it.
+          #
+          # The fallback matters: `actions/checkout` rejects an empty `token:`
+          # outright ("Input required and not supplied"), which would break this
+          # repository's own checkout while the secret is unset, rather than leaving
+          # only the submodule to fail.
           submodules: true
+          token: ${{ secrets.MEDIA_CONVERT_TOKEN || github.token }}
 
       - name: Create .env file
         run: |
diff --git a/.github/workflows/cms-unit-tests.yml b/.github/workflows/cms-unit-tests.yml
index 6fdc0dffa3..9245851823 100644
--- a/.github/workflows/cms-unit-tests.yml
+++ b/.github/workflows/cms-unit-tests.yml
@@ -23,10 +23,20 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
         with:
-          # The encoder's player packages are consumed from luminary-media-convert/, which is
-          # a submodule rather than a published package. The submodule repository is
-          # public, so the built-in token suffices; no extra credential is needed.
+          # The encoder's player packages are consumed from luminary-media-convert/,
+          # which is a submodule rather than a published package.
+          #
+          # That repository is private, and a workflow's GITHUB_TOKEN reaches only the
+          # repository it runs in — a private sibling answers "Repository not found"
+          # and checkout aborts before any step runs. MEDIA_CONVERT_TOKEN is a
+          # credential with read access to it.
+          #
+          # The fallback matters: `actions/checkout` rejects an empty `token:`
+          # outright ("Input required and not supplied"), which would break this
+          # repository's own checkout while the secret is unset, rather than leaving
+          # only the submodule to fail.
           submodules: true
+          token: ${{ secrets.MEDIA_CONVERT_TOKEN || github.token }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v6