diff --git a/hosts/common/programs.nix b/hosts/common/programs.nix
index d34b746d..d98a3979 100644
--- a/hosts/common/programs.nix
+++ b/hosts/common/programs.nix
@@ -98,6 +98,7 @@ let
       efivar
       flashrom
       fwupd
+      gh  # MS GitHub cli
       ghostscript  # TODO: imagemagick wrapper should add gs to PATH
       gnupg
       gocryptfs
@@ -319,6 +320,9 @@ in
         # TODO: package [smile](https://github.com/mijorus/smile) for probably a better mobile experience.
         emote.dir = [ ".local/share/Emote" ];
 
+        # MS GitHub stores auth token in .config
+        gh.private = [ ".config/gh" ];
+
         # XXX: we preserve the whole thing because if we only preserve gPodder/Downloads
         #   then startup is SLOW during feed import, and we might end up with zombie eps in the dl dir.
         gpodder-configured.dir = [ "gPodder" ];