diff --git a/.github/workflows/provisioning-check-reusable.yml b/.github/workflows/provisioning-check-reusable.yml
index ea04c7048..789cee327 100644
--- a/.github/workflows/provisioning-check-reusable.yml
+++ b/.github/workflows/provisioning-check-reusable.yml
@@ -40,6 +40,8 @@ jobs:
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.sha }}
+          # launcher.sh (caller code) runs below: never leave the token in .git/config.
+          persist-credentials: false
 
       - name: Checkout the provisioning canon
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -47,6 +49,7 @@ jobs:
           repository: hyperpolymath/standards
           ref: ${{ job.workflow_sha }}
           path: .standards-checkout
+          persist-credentials: false
           sparse-checkout: |
             3-practice/provisioning/templates/build/just
           sparse-checkout-cone-mode: false