diff --git a/CHANGELOG.md b/CHANGELOG.md
index fe9d8a2..08226ac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,10 @@
 
+# 0.2.16 (2026-10-22)
+
+### Fixed
+
+- Passes the token as the password in authenticated GitHub urls (`https://x-access-token:{token}@github.com/...`), recent libcurl no longer re-sends credentials after a redirect for urls with a username and no password
+
 # 0.2.15 (2025-01-27)
 
 ### Updated
diff --git a/setup.py b/setup.py
index c999e73..7977218 100644
--- a/setup.py
+++ b/setup.py
@@ -5,7 +5,7 @@
     requirements = [c.strip() for c in f.readlines()]
 
 setup(name="wagon_common",
-      version="0.2.15",
+      version="0.2.16",
       description="Le Wagon common packages",
       url="https://github.com/lewagon/python-utilities/",
       author="Sébastien Saunier",
diff --git a/tests/gh/test_gh_repo.py b/tests/gh/test_gh_repo.py
index 635fe0a..fe13553 100644
--- a/tests/gh/test_gh_repo.py
+++ b/tests/gh/test_gh_repo.py
@@ -40,7 +40,7 @@ def test_gh_repo_naming(self):
         assert repo.name == "lewagon-test/data-solutions"
 
         assert repo.ssh_url == f"git@github.com:{repo.owner}/{repo.repo}.git"
-        assert repo.https_url == f"https://None@github.com/{repo.owner}/{repo.repo}.git"
+        assert repo.https_url == f"https://x-access-token:None@github.com/{repo.owner}/{repo.repo}.git"
 
         assert lw_repo.owner == "lewagon"
         assert lw_repo.repo == "myriad"
diff --git a/tests/helpers/gh/test_url.py b/tests/helpers/gh/test_url.py
index b75fc61..22d3a77 100644
--- a/tests/helpers/gh/test_url.py
+++ b/tests/helpers/gh/test_url.py
@@ -80,6 +80,6 @@ def test_repo_creation_auth(self):
         # Act
 
         # Assert
-        assert authed_data_so.url == "https://token@github.com/lewagon/data-solutions"
+        assert authed_data_so.url == "https://x-access-token:token@github.com/lewagon/data-solutions"
 
         # Cleanup
diff --git a/wagon_common/gh/gh_repo.py b/wagon_common/gh/gh_repo.py
index d1edc65..0f85ee7 100644
--- a/wagon_common/gh/gh_repo.py
+++ b/wagon_common/gh/gh_repo.py
@@ -27,7 +27,7 @@ def __init__(self, name, token=None, is_org=True, verbose=False, **kwargs):
 
         self.name, self.owner, self.repo = self.__identify(name)
         self.ssh_url = f"git@github.com:{self.owner}/{self.repo}.git"
-        self.https_url = f"https://{token}@github.com/{self.owner}/{self.repo}.git"
+        self.https_url = f"https://x-access-token:{token}@github.com/{self.owner}/{self.repo}.git"
         self.is_org = is_org
         self.kwargs = kwargs
 
diff --git a/wagon_common/helpers/gh/url.py b/wagon_common/helpers/gh/url.py
index ccfe1cb..9e2e4c6 100644
--- a/wagon_common/helpers/gh/url.py
+++ b/wagon_common/helpers/gh/url.py
@@ -68,13 +68,15 @@ def github_url(fullname, token=None):
     build gh repo url
     formats:
     - https://github.com/{org}/{repo}
-    - https://{token}@github.com/{org}/{repo}
+    - https://x-access-token:{token}@github.com/{org}/{repo}
     # - https://git@github.com/{org}/{repo}
     # - https://{username}@github.com/{org}/{repo}
     # - https://{username}:{token}@github.com/{org}/{repo}
     """
 
-    auth = f"{token}@" if token is not None else ""
+    # the token is passed as the password: recent libcurl does not re-send
+    # credentials after a redirect for urls with a username and no password
+    auth = f"x-access-token:{token}@" if token is not None else ""
 
     repo_url = f"https://{auth}github.com/{fullname}"