diff --git a/action-updates-checker/src/main/kotlin/io/github/typesafegithub/workflows/updates/Reporting.kt b/action-updates-checker/src/main/kotlin/io/github/typesafegithub/workflows/updates/Reporting.kt
index 2743ebabc3..5110620b62 100644
--- a/action-updates-checker/src/main/kotlin/io/github/typesafegithub/workflows/updates/Reporting.kt
+++ b/action-updates-checker/src/main/kotlin/io/github/typesafegithub/workflows/updates/Reporting.kt
@@ -39,7 +39,7 @@ internal suspend fun Workflow.reportAvailableUpdatesInternal(
 ) {
     availableVersionsForEachAction(
         reportWhenTokenUnset = reportWhenTokenUnset,
-        githubAuthToken = githubAuthToken ?: getGithubAuthTokenOrNull(),
+        githubAuthToken = githubAuthToken ?: getGithubAuthTokenOrNull()?.first,
     ).onEach { regularActionVersions ->
         val usesString =
             with(regularActionVersions.action) {
diff --git a/action-updates-checker/src/main/kotlin/io/github/typesafegithub/workflows/updates/Utils.kt b/action-updates-checker/src/main/kotlin/io/github/typesafegithub/workflows/updates/Utils.kt
index 623835f8dc..8fd9f600f5 100644
--- a/action-updates-checker/src/main/kotlin/io/github/typesafegithub/workflows/updates/Utils.kt
+++ b/action-updates-checker/src/main/kotlin/io/github/typesafegithub/workflows/updates/Utils.kt
@@ -17,7 +17,7 @@ import kotlin.io.path.readText
 
 internal suspend fun Workflow.availableVersionsForEachAction(
     reportWhenTokenUnset: Boolean = true,
-    githubAuthToken: String? = getGithubAuthTokenOrNull(),
+    githubAuthToken: String? = getGithubAuthTokenOrNull()?.first,
 ): Flow<RegularActionVersions> {
     if (githubAuthToken == null && !reportWhenTokenUnset) {
         githubWarning("github auth token is required, but not set, skipping api calls")
diff --git a/jit-binding-server/src/main/kotlin/io/github/typesafegithub/workflows/jitbindingserver/MetadataRoutes.kt b/jit-binding-server/src/main/kotlin/io/github/typesafegithub/workflows/jitbindingserver/MetadataRoutes.kt
index d8eab2b804..e36317bd7f 100644
--- a/jit-binding-server/src/main/kotlin/io/github/typesafegithub/workflows/jitbindingserver/MetadataRoutes.kt
+++ b/jit-binding-server/src/main/kotlin/io/github/typesafegithub/workflows/jitbindingserver/MetadataRoutes.kt
@@ -26,7 +26,10 @@ private fun Route.metadata(refresh: Boolean = false) {
         val file = call.parameters["file"] ?: return@get call.respondNotFound()
         val actionCoords = call.parameters.extractActionCoords(extractVersion = false)
 
-        val bindingArtifacts = actionCoords.buildPackageArtifacts(githubAuthToken = getGithubAuthToken())
+        val (githubAuthToken, tokenType) = getGithubAuthToken()
+        // TODO: use tokenType to register a metric on the fallback
+        // TODO: what if getGithubAuthToken() returns null? Looks like destructuring asserts non-null?
+        val bindingArtifacts = actionCoords.buildPackageArtifacts(githubAuthToken = githubAuthToken)
         if (file in bindingArtifacts) {
             when (val artifact = bindingArtifacts[file]) {
                 is String -> call.respondText(text = artifact)
diff --git a/shared-internal/src/main/kotlin/io/github/typesafegithub/workflows/shared/internal/GithubUtils.kt b/shared-internal/src/main/kotlin/io/github/typesafegithub/workflows/shared/internal/GithubUtils.kt
index 122e59d38c..da43f65d13 100644
--- a/shared-internal/src/main/kotlin/io/github/typesafegithub/workflows/shared/internal/GithubUtils.kt
+++ b/shared-internal/src/main/kotlin/io/github/typesafegithub/workflows/shared/internal/GithubUtils.kt
@@ -11,11 +11,13 @@ private val logger = logger { }
  * The token may be of various kind, e.g. a Personal Access Token, or an
  * Application Installation Token.
  */
-fun getGithubAuthTokenOrNull(): String? =
+fun getGithubAuthTokenOrNull(): Pair<String, TokenType>? =
     runBlocking {
         runCatching { getInstallationAccessToken() }
             .onFailure { logger.warn(it) { "Failed to get GitHub App Installation token, falling back to GITHUB_TOKEN." } }
-            .getOrNull() ?: System.getenv("GITHUB_TOKEN")
+            .getOrNull()
+            ?.let { Pair(it, TokenType.InstallationAccessToken) }
+            ?: System.getenv("GITHUB_TOKEN")?.let { Pair(it, TokenType.PersonalAccessToken) }
     }.also { if (it == null) logger.warn { ERROR_NO_CONFIGURATION } }
 
 /**
@@ -24,7 +26,12 @@ fun getGithubAuthTokenOrNull(): String? =
  * The token may be of various kind, e.g. a Personal Access Token, or an
  * Application Installation Token.
  */
-fun getGithubAuthToken(): String = getGithubAuthTokenOrNull() ?: error(ERROR_NO_CONFIGURATION)
+fun getGithubAuthToken(): Pair<String, TokenType> = getGithubAuthTokenOrNull() ?: error(ERROR_NO_CONFIGURATION)
+
+enum class TokenType {
+    InstallationAccessToken,
+    PersonalAccessToken,
+}
 
 private val ERROR_NO_CONFIGURATION =
     """