diff --git a/cmd/cachewd/main.go b/cmd/cachewd/main.go
index 8500782..c868548 100644
--- a/cmd/cachewd/main.go
+++ b/cmd/cachewd/main.go
@@ -68,9 +68,9 @@ func main() {
 
 	// Start initialising
 	tokenManagerProvider := githubapp.NewTokenManagerProvider(globalConfig.GithubAppConfig, logger)
-	tokenManager, err := tokenManagerProvider()
-	kctx.FatalIfErrorf(err)
-	managerProvider := gitclone.NewManagerProvider(ctx, globalConfig.GitCloneConfig, tokenManager)
+	managerProvider := gitclone.NewManagerProvider(ctx, globalConfig.GitCloneConfig, func() (gitclone.CredentialProvider, error) {
+		return tokenManagerProvider()
+	})
 
 	scheduler := jobscheduler.New(ctx, globalConfig.SchedulerConfig)
 
diff --git a/internal/gitclone/manager.go b/internal/gitclone/manager.go
index cbde6a8..3abdc53 100644
--- a/internal/gitclone/manager.go
+++ b/internal/gitclone/manager.go
@@ -63,6 +63,8 @@ type CredentialProvider interface {
 	GetTokenForURL(ctx context.Context, url string) (string, error)
 }
 
+type CredentialProviderProvider func() (CredentialProvider, error)
+
 type Repository struct {
 	mu                 sync.RWMutex
 	config             Config
@@ -87,8 +89,16 @@ type Manager struct {
 // ManagerProvider is a function that lazily creates a singleton Manager.
 type ManagerProvider func() (*Manager, error)
 
-func NewManagerProvider(ctx context.Context, config Config, credentialProvider CredentialProvider) ManagerProvider {
+func NewManagerProvider(ctx context.Context, config Config, credentialProviderProvider CredentialProviderProvider) ManagerProvider {
 	return sync.OnceValues(func() (*Manager, error) {
+		var credentialProvider CredentialProvider
+		if credentialProviderProvider != nil {
+			var err error
+			credentialProvider, err = credentialProviderProvider()
+			if err != nil {
+				return nil, errors.WithStack(err)
+			}
+		}
 		return NewManager(ctx, config, credentialProvider)
 	})
 }