diff --git a/buildbot_nix/buildbot_nix/__init__.py b/buildbot_nix/buildbot_nix/__init__.py
index 63c70b02d..5e3733caa 100644
--- a/buildbot_nix/buildbot_nix/__init__.py
+++ b/buildbot_nix/buildbot_nix/__init__.py
@@ -986,6 +986,7 @@ async def run_vc(
         pr_head = build_props.getProperty("github.head.sha") or build_props.getProperty(
             "head_sha"
         )
+        auth_workdir = self._get_auth_data_workdir()
 
         # Not a PR, fallback to default behavior
         if merge_base is None or pr_head is None:
@@ -1005,33 +1006,42 @@ async def run_vc(
             self.build.path_module.join(self.workdir, ".git")
         )
 
-        if not has_git:
-            await self._dovccmd(["clone", "--recurse-submodules", self.repourl, "."])
+        try:
+            await self._git_auth.download_auth_files_if_needed(auth_workdir)
 
-        patched = await self.sourcedirIsPatched()
+            if not has_git:
+                await self._dovccmd(
+                    ["clone", "--recurse-submodules", self.repourl, "."]
+                )
 
-        if patched:
-            await self._dovccmd(["clean", "-f", "-f", "-d", "-x"])
+            patched = await self.sourcedirIsPatched()
 
-        await self._dovccmd(["fetch", "-f", "-t", self.repourl, merge_base, pr_head])
+            if patched:
+                await self._dovccmd(["clean", "-f", "-f", "-d", "-x"])
 
-        await self._dovccmd(["checkout", "--detach", "-f", pr_head])
+            await self._dovccmd(
+                ["fetch", "-f", "-t", self.repourl, merge_base, pr_head]
+            )
 
-        await self._dovccmd(
-            [
-                "-c",
-                "user.email=buildbot@example.com",
-                "-c",
-                "user.name=buildbot",
-                "merge",
-                "--no-ff",
-                "-m",
-                f"Merge {merge_base} into {pr_head}",
-                merge_base,
-            ]
-        )
-        self.updateSourceProperty("got_revision", pr_head)
-        return await self.parseCommitDescription()
+            await self._dovccmd(["checkout", "--detach", "-f", pr_head])
+
+            await self._dovccmd(
+                [
+                    "-c",
+                    "user.email=buildbot@example.com",
+                    "-c",
+                    "user.name=buildbot",
+                    "merge",
+                    "--no-ff",
+                    "-m",
+                    f"Merge {merge_base} into {pr_head}",
+                    merge_base,
+                ]
+            )
+            self.updateSourceProperty("got_revision", pr_head)
+            return await self.parseCommitDescription()
+        finally:
+            await self._git_auth.remove_auth_files_if_needed(auth_workdir)
 
 
 def nix_eval_config(
@@ -1058,8 +1068,12 @@ def nix_eval_config(
             submodules=True,
             haltOnFailure=True,
             logEnviron=False,
-            sshPrivateKey=project.private_key_path.read_text() if project.private_key_path else None,
-            sshKnownHosts=project.known_hosts_path.read_text() if project.known_hosts_path else None,
+            sshPrivateKey=project.private_key_path.read_text()
+            if project.private_key_path
+            else None,
+            sshKnownHosts=project.known_hosts_path.read_text()
+            if project.known_hosts_path
+            else None,
         ),
     )
     drv_gcroots_dir = util.Interpolate(
@@ -1416,8 +1430,12 @@ def buildbot_effects_config(
             method="clean",
             submodules=True,
             haltOnFailure=True,
-            sshPrivateKey=project.private_key_path.read_text() if project.private_key_path else None,
-            sshKnownHosts=project.known_hosts_path.read_text() if project.known_hosts_path else None,
+            sshPrivateKey=project.private_key_path.read_text()
+            if project.private_key_path
+            else None,
+            sshKnownHosts=project.known_hosts_path.read_text()
+            if project.known_hosts_path
+            else None,
         ),
     )
     secrets_list = []
diff --git a/buildbot_nix/buildbot_nix/gitea_projects.py b/buildbot_nix/buildbot_nix/gitea_projects.py
index c3fcf4708..034fc3cc0 100644
--- a/buildbot_nix/buildbot_nix/gitea_projects.py
+++ b/buildbot_nix/buildbot_nix/gitea_projects.py
@@ -63,8 +63,7 @@ def get_project_url(self) -> str:
         url = urlparse(self.config.instance_url)
         if self.config.ssh_private_key_file:
             return self.data.ssh_url
-        else:
-            return f"{url.scheme}://git:%(secret:{self.config.token_file})s@{url.hostname}/{self.name}"
+        return f"{url.scheme}://git:%(secret:{self.config.token_file})s@{url.hostname}/{self.name}"
 
     def create_change_source(self) -> ChangeSource | None:
         return None
@@ -125,7 +124,6 @@ def known_hosts_path(self) -> Path | None:
         return self.config.ssh_known_hosts_file
 
 
-
 class GiteaBackend(GitBackend):
     config: GiteaConfig
     webhook_secret: str
diff --git a/buildbot_nix/buildbot_nix/projects.py b/buildbot_nix/buildbot_nix/projects.py
index a56949806..64eba7a5c 100644
--- a/buildbot_nix/buildbot_nix/projects.py
+++ b/buildbot_nix/buildbot_nix/projects.py
@@ -1,6 +1,6 @@
 from abc import ABC, abstractmethod
-from typing import Any
 from pathlib import Path
+from typing import Any
 
 from buildbot.changes.base import ChangeSource
 from buildbot.config.builder import BuilderConfig
diff --git a/buildbot_nix/buildbot_nix/pull_based/project.py b/buildbot_nix/buildbot_nix/pull_based/project.py
index 4c090a3d4..eaf202075 100644
--- a/buildbot_nix/buildbot_nix/pull_based/project.py
+++ b/buildbot_nix/buildbot_nix/pull_based/project.py
@@ -1,6 +1,6 @@
+from pathlib import Path
 from typing import Any
 from urllib.parse import ParseResult, urlparse
-from pathlib import Path
 
 from buildbot.changes.base import ChangeSource
 from buildbot.changes.gitpoller import GitPoller