diff --git a/CODEOWNERS b/CODEOWNERS
new file mode 100644
index 00000000..c8dda112
--- /dev/null
+++ b/CODEOWNERS
@@ -0,0 +1 @@
+* @egym/sre
diff --git a/dist/index.js b/dist/index.js
index 5988a2b1..2ef9a261 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -82,7 +82,7 @@ function getProtoc(version, includePreReleases, repoToken) {
         toolPath = tc.find("protoc", version);
         // if not: download, extract and cache
         if (!toolPath) {
-            toolPath = yield downloadRelease(version);
+            toolPath = yield downloadRelease(version, repoToken);
             process.stdout.write("Protoc cached under " + toolPath + os.EOL);
         }
         // expose outputs
@@ -93,7 +93,7 @@ function getProtoc(version, includePreReleases, repoToken) {
     });
 }
 exports.getProtoc = getProtoc;
-function downloadRelease(version) {
+function downloadRelease(version, repoToken) {
     return __awaiter(this, void 0, void 0, function* () {
         // Download
         const fileName = getFileName(version, osPlat, osArch);
@@ -101,7 +101,9 @@ function downloadRelease(version) {
         process.stdout.write("Downloading archive: " + downloadUrl + os.EOL);
         let downloadPath = null;
         try {
-            downloadPath = yield tc.downloadTool(downloadUrl);
+            // Pass authentication token to avoid rate limiting
+            const auth = repoToken ? `token ${repoToken}` : undefined;
+            downloadPath = yield tc.downloadTool(downloadUrl, undefined, auth);
         }
         catch (err) {
             if (err instanceof tc.HTTPError) {
diff --git a/src/installer.ts b/src/installer.ts
index 487238d8..fbbf5f6e 100644
--- a/src/installer.ts
+++ b/src/installer.ts
@@ -59,7 +59,7 @@ export async function getProtoc(
 
   // if not: download, extract and cache
   if (!toolPath) {
-    toolPath = await downloadRelease(version);
+    toolPath = await downloadRelease(version, repoToken);
     process.stdout.write("Protoc cached under " + toolPath + os.EOL);
   }
 
@@ -71,7 +71,10 @@ export async function getProtoc(
   core.addPath(path.join(toolPath, "bin"));
 }
 
-async function downloadRelease(version: string): Promise<string> {
+async function downloadRelease(
+  version: string,
+  repoToken: string,
+): Promise<string> {
   // Download
   const fileName: string = getFileName(version, osPlat, osArch);
   const downloadUrl: string = util.format(
@@ -83,7 +86,9 @@ async function downloadRelease(version: string): Promise<string> {
 
   let downloadPath: string | null = null;
   try {
-    downloadPath = await tc.downloadTool(downloadUrl);
+    // Pass authentication token to avoid rate limiting
+    const auth = repoToken ? `token ${repoToken}` : undefined;
+    downloadPath = await tc.downloadTool(downloadUrl, undefined, auth);
   } catch (err) {
     if (err instanceof tc.HTTPError) {
       core.debug(err.message);