diff --git a/build/build-jasp.sh b/build/build-jasp.sh
index aabc42d..cd28238 100755
--- a/build/build-jasp.sh
+++ b/build/build-jasp.sh
@@ -39,6 +39,16 @@ R_HOME_DIR="${PREFIX}/R"
 
 mkdir -p "$OUT_DIR" /build
 
+# Take the GitHub token out of the environment until the R module build, the
+# only step that needs it. JASP's Tools/CMake/Config.cmake bakes GITHUB_PAT into
+# the application (Desktop/gui/githubpat.h, the default token for its update
+# check) whenever GITHUB_PAT_DEF is empty, so a token visible at configure time
+# ships inside bin/JASP of the public tarball. That happened once and leaked the
+# build token. GITHUB_PAT_DEF is pinned empty for the same reason.
+BUILD_GITHUB_PAT="${GITHUB_PAT:-}"
+unset GITHUB_PAT GITHUB_TOKEN
+export GITHUB_PAT_DEF=""
+
 log() { echo "::  $* "; }
 
 # ------------------------------------------------------------- build caches
@@ -204,6 +214,7 @@ ninja -C "$BUILD_DIR" -j"$JOBS"
 # install_github('jasp-stats/jaspModuleTools'), and anonymous GitHub API rate
 # limits make that fail. When it fails, no bundles are produced at all and the
 # build otherwise looks successful.
+GITHUB_PAT="${BUILD_GITHUB_PAT}"
 if [[ -z "${GITHUB_PAT:-}" ]]; then
   echo "error: GITHUB_PAT is required — jaspModuleTools is installed from GitHub" >&2
   echo "       without it the module build silently produces nothing" >&2
@@ -555,6 +566,17 @@ bash /work/build/bundle-libs.sh "$STAGE_DIR" "$PREFIX"
 # Final sanity check on what is about to be shipped. Each of these has already
 # been shipped missing once.
 log "verifying the staged tree"
+# The token must never reach the package (see the top of this script). Check
+# for its exact value and for anything shaped like a GitHub token.
+if [[ -n "${BUILD_GITHUB_PAT}" ]] && grep -rlaF -- "${BUILD_GITHUB_PAT}" "$STAGE_DIR" >/dev/null 2>&1; then
+  echo "error: the build's GitHub token is embedded in the staged tree:" >&2
+  grep -rlaF -- "${BUILD_GITHUB_PAT}" "$STAGE_DIR" | sed "s|^$STAGE_DIR||" >&2
+  exit 1
+fi
+if grep -rlaE 'github_pat_[A-Za-z0-9_]{60,}|gh[pousr]_[A-Za-z0-9]{36}' "$STAGE_DIR/opt/jasp-desktop/bin" >/dev/null 2>&1; then
+  echo "error: something shaped like a GitHub token is in the JASP binaries" >&2
+  exit 1
+fi
 staged_r="$STAGE_DIR$PREFIX/R/lib/R/lib"
 for lib in libR.so libRblas.so libRlapack.so; do
   [[ -f "$staged_r/$lib" ]] || { echo "error: staged tree lacks $lib" >&2; exit 1; }