diff --git a/apps/www/scripts/fetchAgentSkills.mjs b/apps/www/scripts/fetchAgentSkills.mjs
index 36a70cf87f0..ff09f5c350c 100644
--- a/apps/www/scripts/fetchAgentSkills.mjs
+++ b/apps/www/scripts/fetchAgentSkills.mjs
@@ -8,7 +8,8 @@
  * URLs — no rewriting needed on this side.
  *
  * Spec: https://github.com/agentskills/agentskills/pull/254
- * Runs unauthenticated — public repo, build-time only.
+ * Uses AGENT_SKILLS_GITHUB_TOKEN if set to avoid GitHub's unauthenticated
+ * rate limit (60 req/hr per IP, shared across Vercel build machines).
  */
 
 import { promises as fs } from 'node:fs'
@@ -20,7 +21,11 @@ const OUT_DIR = join(__dirname, '..', 'public', '.well-known', 'agent-skills')
 const REPO = 'supabase/agent-skills'
 
 async function fetchJson(url) {
-  const res = await fetch(url, { headers: { 'User-Agent': 'supabase-www-build' } })
+  const headers = { 'User-Agent': 'supabase-www-build' }
+  if (process.env.AGENT_SKILLS_GITHUB_TOKEN) {
+    headers['Authorization'] = `Bearer ${process.env.AGENT_SKILLS_GITHUB_TOKEN}`
+  }
+  const res = await fetch(url, { headers })
   if (!res.ok) throw new Error(`GET ${url} → ${res.status}`)
   return res.json()
 }
diff --git a/apps/www/turbo.jsonc b/apps/www/turbo.jsonc
index 09078f17514..a42001db674 100644
--- a/apps/www/turbo.jsonc
+++ b/apps/www/turbo.jsonc
@@ -76,6 +76,7 @@
         "FORCE_ASSET_CDN",
         "ASSET_CDN_S3_ENDPOINT",
         "SITE_NAME",
+        "AGENT_SKILLS_GITHUB_TOKEN",
         "LUMA_API_KEY",
         "LUMA_HACKATHONS_API_KEY",
         "NEXT_RUNTIME",