diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index 772407d..4e34f84 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -53,6 +53,10 @@ jobs:
     env:
       GOPRIVATE: ${{ inputs.goprivate }}
     steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Configure Git for private modules
         if: inputs.goprivate != ''
         env:
@@ -62,8 +66,6 @@ jobs:
             git config --global url."https://${GH_PAT}@github.com/".insteadOf "https://github.com/"
           fi
 
-      - uses: actions/checkout@v4
-
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '' }}
@@ -96,6 +98,10 @@ jobs:
     env:
       GOPRIVATE: ${{ inputs.goprivate }}
     steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Configure Git for private modules
         if: inputs.goprivate != ''
         env:
@@ -105,8 +111,6 @@ jobs:
             git config --global url."https://${GH_PAT}@github.com/".insteadOf "https://github.com/"
           fi
 
-      - uses: actions/checkout@v4
-
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '' }}
@@ -133,6 +137,10 @@ jobs:
     env:
       GOPRIVATE: ${{ inputs.goprivate }}
     steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Configure Git for private modules
         if: inputs.goprivate != ''
         env:
@@ -142,8 +150,6 @@ jobs:
             git config --global url."https://${GH_PAT}@github.com/".insteadOf "https://github.com/"
           fi
 
-      - uses: actions/checkout@v4
-
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '' }}