diff --git a/.github/workflows/build_frontend.yml b/.github/workflows/build_frontend.yml
index f37f0947..f487306e 100644
--- a/.github/workflows/build_frontend.yml
+++ b/.github/workflows/build_frontend.yml
@@ -43,7 +43,10 @@ jobs:
           if [[ -n "$(git status --porcelain frontend/dist)" ]]; then
             git add frontend/dist
             git commit -m "ci: rebuild frontend/dist [skip ci]"
-            git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}"
+            # gh reads GH_TOKEN from the env; `gh auth login` would refuse
+            # to run while it is set.
+            gh auth setup-git
+            git push origin "HEAD:${GITHUB_REF_NAME}"
           else
             echo "frontend/dist already up to date"
           fi