diff --git a/.github/workflows/test_latest_release.yml b/.github/workflows/test_latest_release.yml
index adddebbe..34d0aab6 100644
--- a/.github/workflows/test_latest_release.yml
+++ b/.github/workflows/test_latest_release.yml
@@ -12,6 +12,8 @@ permissions: {}
 jobs:
   test-latest-release:
     runs-on: [ubuntu-22.04]
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
@@ -31,3 +33,5 @@ jobs:
 
       - name: Run all tests with latest roc release + latest basic-cli release
         run: EXAMPLES_DIR=./examples/ ./ci/test_latest_release.sh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/ci/test_latest_release.sh b/ci/test_latest_release.sh
index 06d15e09..0c038e09 100755
--- a/ci/test_latest_release.sh
+++ b/ci/test_latest_release.sh
@@ -32,7 +32,7 @@ mv "$NIGHTLY_FOLDER" roc_nightly
 ./roc_nightly/roc version
 
 # Get the latest basic-cli release file URL
-CLI_RELEASES_JSON=$(curl -s https://api.github.com/repos/roc-lang/basic-cli/releases)
+CLI_RELEASES_JSON=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" https://api.github.com/repos/roc-lang/basic-cli/releases)
 CLI_RELEASE_URL=$(echo $CLI_RELEASES_JSON | jq -r '.[0].assets | .[] | select(.name | test("\\.tar\\.br$")) | .browser_download_url')
 
 # Use the latest basic-cli release as the platform for every example