diff --git a/odoo_devkit/local_runtime.py b/odoo_devkit/local_runtime.py
index bec2754..33dd2cb 100644
--- a/odoo_devkit/local_runtime.py
+++ b/odoo_devkit/local_runtime.py
@@ -2131,12 +2131,14 @@ def resolve_source_repository_ref_to_git_sha(*, repository: str, ref: str, githu
     execution_env = command_execution_env()
     normalized_token = clean_optional_value(github_token)
     if normalized_token and remote_url.startswith("https://github.com/"):
-        encoded_auth = base64.b64encode(f"x-access-token:{normalized_token}".encode()).decode("ascii")
         execution_env.update(
             {
-                "GIT_CONFIG_COUNT": "1",
-                "GIT_CONFIG_KEY_0": "http.https://github.com/.extraheader",
-                "GIT_CONFIG_VALUE_0": f"AUTHORIZATION: basic {encoded_auth}",
+                "ODOO_DEVKIT_GITHUB_TOKEN": normalized_token,
+                "GIT_CONFIG_COUNT": "2",
+                "GIT_CONFIG_KEY_0": "credential.https://github.com.helper",
+                "GIT_CONFIG_VALUE_0": "!f() { echo username=x-access-token; echo password=$ODOO_DEVKIT_GITHUB_TOKEN; }; f",
+                "GIT_CONFIG_KEY_1": "credential.useHttpPath",
+                "GIT_CONFIG_VALUE_1": "true",
             }
         )
     ls_remote_result = subprocess.run(
diff --git a/tests/test_runtime.py b/tests/test_runtime.py
index 372c3c4..f5072ec 100644
--- a/tests/test_runtime.py
+++ b/tests/test_runtime.py
@@ -1610,6 +1610,33 @@ def test_resolve_source_repository_ref_to_git_sha_rejects_missing_remote_ref(sel
                     ref="main",
                 )
 
+    def test_resolve_source_repository_ref_to_git_sha_uses_credential_helper(self) -> None:
+        with mock.patch(
+            "odoo_devkit.local_runtime.subprocess.run",
+            return_value=mock.Mock(
+                returncode=0,
+                stdout="411f6b8e85cac72dc7aa2e2dc5540001043c327d\trefs/heads/main\n",
+                stderr="",
+            ),
+        ) as run_mock:
+            resolved_ref = local_runtime.resolve_source_repository_ref_to_git_sha(
+                repository="cbusillo/disable_odoo_online",
+                ref="main",
+                github_token="source-token",
+            )
+
+        self.assertEqual(resolved_ref, "411f6b8e85cac72dc7aa2e2dc5540001043c327d")
+        execution_env = run_mock.call_args.kwargs["env"]
+        self.assertEqual(execution_env["ODOO_DEVKIT_GITHUB_TOKEN"], "source-token")
+        self.assertEqual(execution_env["GIT_CONFIG_COUNT"], "2")
+        self.assertEqual(execution_env["GIT_CONFIG_KEY_0"], "credential.https://github.com.helper")
+        self.assertEqual(
+            execution_env["GIT_CONFIG_VALUE_0"],
+            "!f() { echo username=x-access-token; echo password=$ODOO_DEVKIT_GITHUB_TOKEN; }; f",
+        )
+        self.assertEqual(execution_env["GIT_CONFIG_KEY_1"], "credential.useHttpPath")
+        self.assertEqual(execution_env["GIT_CONFIG_VALUE_1"], "true")
+
     def test_resolve_artifact_runtime_source_refs_uses_environment_token_fallback(self) -> None:
         runtime_values = {
             "ODOO_ADDON_REPOSITORIES": "cbusillo/disable_odoo_online@main",