diff --git a/README.md b/README.md
index b84b01cb..45aaa33d 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ Change how your team works.
  
 
 
-# tea/cli 0.6.7
+# tea/cli 0.6.8
 
 tea is a universal virtual‑environment manager:
 
diff --git a/src/hooks/useCache.ts b/src/hooks/useCache.ts
index 48d6ba39..d0dbbe91 100644
--- a/src/hooks/useCache.ts
+++ b/src/hooks/useCache.ts
@@ -41,14 +41,6 @@ const download = async (opts: DownloadOptions) => {
   case 'src': {
     const extname = new Path(url.pathname).extname()
     dst = path({ pkg: opts.pkg, type: 'src', extname })
-
-    //FIXME: big hacks
-    if (opts.pkg.project === "tea.xyz" && url.host === "github.com") {
-      const token = Deno.env.get("GITHUB_TOKEN")
-      if (!token) { throw new Error("private repos require a GITHUB_TOKEN") }
-      headers["Authorization"] = `bearer ${token}`
-    }
-
   } break
   case 'script':
     dst = undefined
diff --git a/src/hooks/useDownload.ts b/src/hooks/useDownload.ts
index 63d1d3a3..08ad93bb 100644
--- a/src/hooks/useDownload.ts
+++ b/src/hooks/useDownload.ts
@@ -24,7 +24,6 @@ async function download({ src, dst, headers, ephemeral }: DownloadOptions): Prom
   dst ??= hash().join(src.path().basename())
   if (src.protocol === "file:") throw new Error()
 
-
   if (!ephemeral && mtime_entry().isFile() && dst.isReadableFile()) {
     headers ??= {}
     headers["If-Modified-Since"] = await mtime_entry().read()
@@ -33,6 +32,15 @@ async function download({ src, dst, headers, ephemeral }: DownloadOptions): Prom
     console.info({downloading: src.toString()})
   }
 
+  // so the user can add private repos if they need to etc.
+  if (/(^|\.)github.com$/.test(src.host)) {
+    const token = Deno.env.get("GITHUB_TOKEN")
+    if (token) {
+      headers ??= {}
+      headers["Authorization"] = `bearer ${token}`
+    }
+  }
+
   const rsp = await fetch(src, {headers})
 
   switch (rsp.status) {