diff --git a/Library/Homebrew/brew.sh b/Library/Homebrew/brew.sh
index 7d47ab4333..6f84e4eb52 100644
--- a/Library/Homebrew/brew.sh
+++ b/Library/Homebrew/brew.sh
@@ -818,6 +818,16 @@ then
   export GIT_SSH_COMMAND="ssh -F${HOMEBREW_SSH_CONFIG_PATH}"
 fi
 
+if [[ -n "${HOMEBREW_ARTIFACT_DOMAIN}" && -n "${HOMEBREW_DOCKER_REGISTRY_TOKEN}" ]]
+then
+  export HOMEBREW_GITHUB_PACKAGES_AUTH="Bearer ${HOMEBREW_DOCKER_REGISTRY_TOKEN}"
+elif [[ -n "${HOMEBREW_ARTIFACT_DOMAIN}" && -n "${HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN}" ]]
+then
+  export HOMEBREW_GITHUB_PACKAGES_AUTH="Basic ${HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN}"
+else
+  export HOMEBREW_GITHUB_PACKAGES_AUTH="Bearer QQ=="
+fi
+
 if [[ -n "${HOMEBREW_BASH_COMMAND}" ]]
 then
   # source rather than executing directly to ensure the entire file is read into
diff --git a/Library/Homebrew/cmd/vendor-install.sh b/Library/Homebrew/cmd/vendor-install.sh
index 1cda2e6a71..72a56dde02 100644
--- a/Library/Homebrew/cmd/vendor-install.sh
+++ b/Library/Homebrew/cmd/vendor-install.sh
@@ -119,7 +119,7 @@ fetch() {
     --remote-time
     --location
     --user-agent "${HOMEBREW_USER_AGENT_CURL}"
-    --header "Authorization: Bearer ${HOMEBREW_DOCKER_REGISTRY_TOKEN:-QQ==}"
+    --header "Authorization: ${HOMEBREW_GITHUB_PACKAGES_AUTH}"
   )
 
   if [[ -n "${HOMEBREW_QUIET}" ]]
diff --git a/Library/Homebrew/download_strategy.rb b/Library/Homebrew/download_strategy.rb
index d7bbc573b6..45429fdd5f 100644
--- a/Library/Homebrew/download_strategy.rb
+++ b/Library/Homebrew/download_strategy.rb
@@ -595,14 +595,9 @@ class CurlGitHubPackagesDownloadStrategy < CurlDownloadStrategy
   def initialize(url, name, version, **meta)
     meta ||= {}
     meta[:headers] ||= []
-    meta[:headers] << if Homebrew::EnvConfig.artifact_domain && Homebrew::EnvConfig.docker_registry_token
-      "Authorization: Bearer #{Homebrew::EnvConfig.docker_registry_token}"
-    elsif Homebrew::EnvConfig.artifact_domain && Homebrew::EnvConfig.docker_registry_basic_auth_token
-      "Authorization: Basic #{Homebrew::EnvConfig.docker_registry_basic_auth_token}"
-    else
-      # This QQ== is needed for the no-auth GitHub Packages default.
-      "Authorization: Bearer QQ=="
-    end
+    # GitHub Packages authorization header.
+    # HOMEBREW_GITHUB_PACKAGES_AUTH set in brew.sh
+    meta[:headers] << "Authorization: #{HOMEBREW_GITHUB_PACKAGES_AUTH}"
     super(url, name, version, meta)
   end
 
diff --git a/Library/Homebrew/global.rb b/Library/Homebrew/global.rb
index b84cfaa3f2..7ba25e07cd 100644
--- a/Library/Homebrew/global.rb
+++ b/Library/Homebrew/global.rb
@@ -52,6 +52,7 @@ HOMEBREW_USER_AGENT_RUBY =
 HOMEBREW_USER_AGENT_FAKE_SAFARI =
   "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/602.4.8 " \
   "(KHTML, like Gecko) Version/10.0.3 Safari/602.4.8"
+HOMEBREW_GITHUB_PACKAGES_AUTH = ENV["HOMEBREW_GITHUB_PACKAGES_AUTH"]
 
 HOMEBREW_DEFAULT_PREFIX = "/usr/local"
 HOMEBREW_DEFAULT_REPOSITORY = "#{HOMEBREW_DEFAULT_PREFIX}/Homebrew"