diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 0cde6e85..aec50b2c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: 'Run pre-build steps'
-        run: build-scripts/prebuild
+        run: build-scripts/prebuild ${{ secrets.GITHUB_TOKEN }}
       - name: 'Upload documentation for later build steps'
         uses: actions/upload-artifact@v3
         with:
diff --git a/build-scripts/download-external-libs b/build-scripts/download-external-libs
index 5c437c23..79c9d348 100755
--- a/build-scripts/download-external-libs
+++ b/build-scripts/download-external-libs
@@ -30,16 +30,23 @@ src_name = 'qpdf-external-libs-src.zip'
 dir_name = 'external-libs-dist'
 os.makedirs(dir_name, exist_ok=True)
 
+github_headers = {
+    'content-type': 'application/json',
+}
+try:
+    token = sys.argv[1]
+    github_headers['authorization'] = f'Bearer {token}'
+except IndexError:
+    print('WARNING: unauthenticated call to github API'
+          ' will be subject to more stringent rate limits.')
+
 r = requests.get(
-    'https://api.github.com/repos/qpdf/external-libs/releases')
+    'https://api.github.com/repos/qpdf/external-libs/releases',
+    headers=github_headers)
+if r.status_code >= 400:
+    exit(f'GitHub API call returned status {r.status_code}: {r.text}')
+
 releases = json.loads(r.text)
-
-# Help diagnose occasional failure where some releases don't have
-# 'prerelease'. I've never seen this in attempts to reproduce.
-print("---- github API output for external-libs releaes ----")
-print(json.dumps(releases, indent=2, separators=(',', ': ')))
-print("--------")
-
 by_tag = sorted(
     [(r['tag_name'], r) for r in releases
      if r['prerelease'] is False],
diff --git a/build-scripts/prebuild b/build-scripts/prebuild
index 44b59949..00f48dd3 100755
--- a/build-scripts/prebuild
+++ b/build-scripts/prebuild
@@ -1,6 +1,13 @@
 #!/bin/bash
 set -e
 cd $(dirname $0)/..
+
+token=$1
+if [ "$token" = "" ]; then
+    echo 1>&2 "Usage: $0 github-token"
+    exit 2
+fi
+
 if ! ./generate_auto_job --check; then
    cat 1>&2 <<EOF
 
@@ -18,4 +25,4 @@ EOF
    exit 2
 fi
 build-scripts/build-doc
-build-scripts/download-external-libs
+build-scripts/download-external-libs $token