diff --git a/tools/_rapids-get-pr-artifact-github b/tools/_rapids-get-pr-artifact-github
index 2c5636b..b1c2b94 100755
--- a/tools/_rapids-get-pr-artifact-github
+++ b/tools/_rapids-get-pr-artifact-github
@@ -20,6 +20,8 @@ if [[ "${package_format}" = "wheel" && -z "${RAPIDS_PY_WHEEL_NAME:+placeholder}"
     exit 1
 fi
 
+source rapids-prompt-local-github-auth
+
 # If commit is not provided, get the latest commit on the PR
 if [[ -z "${commit}" ]]; then
     commit=$(rapids-retry --quiet gh pr view "${pr}" --repo rapidsai/"${repo}" --json headRefOid --jq '.headRefOid')
diff --git a/tools/rapids-download-conda-from-github b/tools/rapids-download-conda-from-github
index 8ec5f19..ec72940 100755
--- a/tools/rapids-download-conda-from-github
+++ b/tools/rapids-download-conda-from-github
@@ -8,7 +8,6 @@ set -euo pipefail
 export RAPIDS_SCRIPT_NAME="rapids-download-conda-from-github"
 
 source rapids-prompt-local-repo-config
-source rapids-prompt-local-github-auth
 
 # Validate package type argument
 pkg_type="$1"
diff --git a/tools/rapids-download-from-github b/tools/rapids-download-from-github
index b7c7f99..8d370f7 100755
--- a/tools/rapids-download-from-github
+++ b/tools/rapids-download-from-github
@@ -7,11 +7,13 @@
 set -euo pipefail
 export RAPIDS_SCRIPT_NAME="rapids-download-from-github"
 
-if [ -z "$1" ]; then
+if [ -z "${1:-}" ]; then
   rapids-echo-stderr "Must specify input arguments: PKG_NAME"
   exit 1
 fi
 
+source rapids-prompt-local-github-auth
+
 github_run_id="$(rapids-github-run-id)"
 pkg_name="$1"
 unzip_dest="${RAPIDS_UNZIP_DIR:-$(mktemp -d)}"
diff --git a/tools/rapids-download-wheels-from-github b/tools/rapids-download-wheels-from-github
index 0fd5d2b..3c5fafe 100755
--- a/tools/rapids-download-wheels-from-github
+++ b/tools/rapids-download-wheels-from-github
@@ -9,7 +9,6 @@ set -eo pipefail
 export RAPIDS_SCRIPT_NAME="rapids-download-wheels-from-github"
 
 source rapids-prompt-local-repo-config
-source rapids-prompt-local-github-auth
 
 # Validate package type argument
 pkg_type="$1"
diff --git a/tools/rapids-github-run-id b/tools/rapids-github-run-id
index 63dcb9c..cc304c8 100755
--- a/tools/rapids-github-run-id
+++ b/tools/rapids-github-run-id
@@ -20,6 +20,8 @@
 set -euo pipefail
 export RAPIDS_SCRIPT_NAME="rapids-github-run-id"
 
+source rapids-prompt-local-github-auth
+
 # While called by CI, all the environment variables are set by the caller. However when run locally, these environment variables are set by rapids-prompt-local-repo-config
 case "${RAPIDS_BUILD_TYPE}" in
   pull-request)
diff --git a/tools/rapids-prompt-local-github-auth b/tools/rapids-prompt-local-github-auth
index a0d3ab0..58b5b9e 100755
--- a/tools/rapids-prompt-local-github-auth
+++ b/tools/rapids-prompt-local-github-auth
@@ -1,10 +1,30 @@
 #!/bin/bash
 #
-# A utility script that prompts user to authenticate with GitHub in
-# local environments
+# Checks if the current environment is authenticated to communicate with the GitHub API.
+#
+# If not, prompts for an interactive login to generate short-lived credentials.
+#
+# This exists primarily for interactive use cases, like trying to reproduce CI locally.
+#
+
+if ! gh auth status >/dev/null 2>&1; then
+    rapids-echo-stderr "No GitHub authentication detected."
+    rapids-echo-stderr "Please authenticate with GitHub to continue."
+    rapids-echo-stderr "To avoid these interactive prompts in the future, set environment variable 'GH_TOKEN' or run 'gh auth login' with the GitHub CLI."
 
-if [ -z "${GH_TOKEN:-}" ] && [ -z "${GITHUB_TOKEN:-}" ]; then
-  rapids-echo-stderr "No GitHub token detected in environment"
-  rapids-echo-stderr "Please authenticate with GitHub to continue"
-  gh auth login --web --git-protocol https
+    # Prompt for interactive login.
+    #
+    # By omitting --scopes, this will generate a short-lived GitHub auth token
+    # with only the minimum required scopes.
+    #
+    # You can run 'gh auth status' afterwards to check the scopes the GitHub CLI granted.
+    if ! gh auth login \
+        --web \
+        --git-protocol https \
+        --hostname "github.com" \
+        --skip-ssh-key;
+    then
+        rapids-echo-stderr "GitHub authentication failed. Exiting.";
+        exit 1;
+    fi
 fi