diff --git a/act/model/github_context.go b/act/model/github_context.go
index e7c8809e..6c4c7e60 100644
--- a/act/model/github_context.go
+++ b/act/model/github_context.go
@@ -213,3 +213,10 @@ func (ghc *GithubContext) SetBaseAndHeadRef() {
 		}
 	}
 }
+
+func (ghc *GithubContext) GetToken(url string) string {
+	if url != ghc.ServerURL {
+		return ""
+	}
+	return ghc.Token
+}
diff --git a/act/runner/step_action_remote.go b/act/runner/step_action_remote.go
index fdbbf794..6cbde2e3 100644
--- a/act/runner/step_action_remote.go
+++ b/act/runner/step_action_remote.go
@@ -109,16 +109,10 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 
 		actionDir := filepath.Join(sar.RunContext.ActionCacheDir(), sar.Step.UsesHash())
 		gitClone := stepActionRemoteNewCloneExecutor(git.NewGitCloneExecutorInput{
-			URL:   sar.remoteAction.CloneURL(sar.RunContext.Config.DefaultActionInstance),
-			Ref:   sar.remoteAction.Ref,
-			Dir:   actionDir,
-			Token: "", /*
-				Shouldn't provide token when cloning actions,
-				the token comes from the instance which triggered the task,
-				however, it might be not the same instance which provides actions.
-				For GitHub, they are the same, always github.com.
-				But for Gitea, tasks triggered by a.com can clone actions from b.com.
-			*/
+			URL:         sar.remoteAction.CloneURL(sar.RunContext.Config.DefaultActionInstance),
+			Ref:         sar.remoteAction.Ref,
+			Dir:         actionDir,
+			Token:       github.GetToken(sar.remoteAction.URL),
 			OfflineMode: sar.RunContext.Config.ActionOfflineMode,
 
 			InsecureSkipTLS: sar.cloneSkipTLS(), // For Gitea