diff --git a/.gitignore b/.gitignore
index 6e41ad01..1d874a7f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,6 +48,9 @@ jspm_packages
 .yarn-integrity
 
 
+# Local secrets (GITHUB_TOKEN)
+.env
+
 # Build output and Astro caches
 dist/
 .astro/
diff --git a/README.md b/README.md
index 66324c64..4c0994e7 100644
--- a/README.md
+++ b/README.md
@@ -118,7 +118,8 @@ npm run lint:js    # ESLint;  lint:css = Stylelint, format = Prettier
 npm run clean      # remove build output and caches
 ```
 
-Module and "Good First Issue" data come from the GitHub GraphQL API and need a GitHub [personal access token] (no extra scopes) in the environment as `GITHUB_TOKEN`.
+Module and "Good First Issue" data come from the GitHub GraphQL API and need a GitHub [personal access token] (no extra scopes) in the environment as `GITHUB_TOKEN`, or in a git-ignored `.env` file in the project root (`GITHUB_TOKEN=...`).
+With the GitHub CLI you can pass your login token for one build: `GITHUB_TOKEN=$(gh auth token) npm run build`.
 Without it the build still completes: it warns and renders module pages from previously cached data, or empty if there is none.
 Fetched data is cached for 12 hours in `.astro/`; `npm run clean` forces a refetch.
 Contributor program topics and mentors come from public Trello boards and need no token.
diff --git a/src/loaders/github.ts b/src/loaders/github.ts
index 39843ba9..461e8dce 100644
--- a/src/loaders/github.ts
+++ b/src/loaders/github.ts
@@ -78,6 +78,18 @@ async function gql<T>(token: string, query: string, variables = {}): Promise<T>
   return json.data;
 }
 
+/** GITHUB_TOKEN from the environment, else from a local .env file. */
+function githubToken(): string | undefined {
+  if (!process.env.GITHUB_TOKEN) {
+    try {
+      process.loadEnvFile();
+    } catch {
+      // no .env file
+    }
+  }
+  return process.env.GITHUB_TOKEN;
+}
+
 /**
  * Wraps a fetch in the shared policy: reuse store data younger than 12h,
  * and without GITHUB_TOKEN (or on fetch errors) keep whatever is stored.
@@ -94,7 +106,7 @@ function cachedLoader(
         logger.info(`using cached data (${store.keys().length} entries)`);
         return;
       }
-      const token = process.env.GITHUB_TOKEN;
+      const token = githubToken();
       if (!token) {
         logger.warn(`GITHUB_TOKEN not set; keeping ${store.keys().length} cached entries`);
         return;