- Added support for checking out private GitHub repositories on self-hosted agents using temporary, read-only GitHub App tokens, eliminating the need for long-lived SSH keys or personal access tokens.
- Feature is off by default; enable per queue in settings or via API/Terraform, requiring Buildkite agent v3.63.1+ and the full‑access GitHub App integration.
- Tokens are scoped to a single repository, expire after one hour, and work for GitHub.com and GitHub Enterprise Server via HTTPS.