wtf? lets try this

.github/workflows/website.yaml

@@ -112,12 +112,17 @@ jobs:
 
       # Future proofing for Reforged: we'll have both closed and open repos, so
       # we need to handle them here instead of disabling submodules outright
+      # checkout's persisted credentials are scoped to the root .git, so submodule clones need the token passed explicitly
       - name: Checkout submodules
+        env:
+          TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: |
+          AUTH="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
+
           if [ "$HAS_ROOT_REPO_CONTEXT" = "true" ]; then
-            git submodule update --init --recursive --depth=1
+            git -c "http.https://github.com/.extraheader=$AUTH" submodule update --init --recursive --depth=1
           else
-            git submodule update --init --recursive --depth=1 -- . ':!packages/closed'
+            git -c "http.https://github.com/.extraheader=$AUTH" submodule update --init --recursive --depth=1 -- . ':!packages/closed'
           fi
 
       - name: Setup bun