GitHub git operations over HTTPS require HTTP Basic auth with
x-access-token:<token>, not the Bearer scheme used by the REST API.

diff --git a/Cargo.toml b/Cargo.toml
index 6b57c3a..65d34ce 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,6 +7,7 @@ axum = "*"
 axum-extra = { version = "*", features = ["typed-header"] }
 tower-http = { version = "*", features = ["trace"] }
 clap = { version = "*", features = ["derive", "env"] }
+base64 = "*"
 facet = "*"
 fs-err = "*"
 jiff = { version = "*", features = ["serde"] }
diff --git a/quire-server/Cargo.toml b/quire-server/Cargo.toml
index 7ccfcb3..1349daf 100644
--- a/quire-server/Cargo.toml
+++ b/quire-server/Cargo.toml
@@ -18,6 +18,7 @@ path = "src/bin/quire/main.rs"
 [dependencies]
 quire-core = { path = "../quire-core" }
 
+base64 = { workspace = true }
 fs-err = { workspace = true, features = ["tokio"] }
 jiff = { workspace = true }
 miette = { workspace = true, features = ["fancy"] }
diff --git a/quire-server/src/mirror.rs b/quire-server/src/mirror.rs
index a96171f..8ad1887 100644
--- a/quire-server/src/mirror.rs
+++ b/quire-server/src/mirror.rs
@@ -86,7 +86,13 @@ fn mirror_ref(
         .env("GIT_CONFIG_KEY_0", "http.extraHeader")
         .env(
             "GIT_CONFIG_VALUE_0",
-            format!("Authorization: Bearer {token}"),
+            format!(
+                "Authorization: Basic {}",
+                base64::Engine::encode(
+                    &base64::engine::general_purpose::STANDARD,
+                    format!("x-access-token:{token}"),
+                )
+            ),
         )
         .stdout(std::process::Stdio::piped())
         .stderr(std::process::Stdio::piped())