diff --git a/README.md b/README.md
index 5f5a774..12e6683 100644
--- a/README.md
+++ b/README.md
@@ -74,7 +74,7 @@ Once installed, run it from your AI agent with `/linear-release-setup` (or just
 | `log_level`     | No       |          | Log verbosity: `quiet` or `verbose`. Omit for default output.                                                                                                                                                                 |
 | `timeout`       | No       | `60`     | Maximum time in seconds to wait for the command to complete                                                                                                                                                                   |
 | `cli_version`   | No       | `v0.18.0` | Linear Release CLI version to install                                                                                                                                                                                         |
-| `github_token`  | No       | `${{ github.token }}` | GitHub token used to authenticate the CLI download. Authenticating avoids the low anonymous rate limit that can fail on busy or shared runners. Defaults to the workflow's automatic token; pass your own token to use a higher rate limit. |
+| `github_token`  | No       | `${{ github.token }}` on github.com | github.com token used to authenticate the CLI download. Authenticating avoids the low anonymous rate limit that can fail on busy or shared runners. Defaults to the workflow's automatic token; pass your own token to use a higher rate limit. On GitHub Enterprise the automatic token isn't valid for github.com, so the download is anonymous unless you pass a github.com token. If anonymous requests hit the rate limit, pass a fine-grained personal access token with no permissions. |
 
 ## Outputs
 
diff --git a/action.yml b/action.yml
index 900bfaa..f818c2c 100644
--- a/action.yml
+++ b/action.yml
@@ -69,9 +69,9 @@ inputs:
     required: false
     default: v0.18.0
   github_token:
-    description: GitHub token used to authenticate release metadata and downloads. Defaults to the workflow's automatic token, which avoids the lower anonymous API rate limit.
+    description: github.com token used to authenticate release metadata and downloads. Defaults to the workflow's automatic token on github.com, which avoids the lower anonymous API rate limit. On GitHub Enterprise the automatic token is not valid for github.com, so requests are anonymous unless you pass a github.com token.
     required: false
-    default: ${{ github.token }}
+    default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
 
 outputs:
   release-id:
diff --git a/install.sh b/install.sh
index 458844f..b58e238 100644
--- a/install.sh
+++ b/install.sh
@@ -26,7 +26,10 @@ fetch_release() {
   if [[ -n "${GITHUB_TOKEN:-}" ]]; then
     api_curl_args+=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
   fi
-  curl "${api_curl_args[@]}" "${RELEASES_API}/${endpoint}"
+  if ! curl "${api_curl_args[@]}" "${RELEASES_API}/${endpoint}"; then
+    error "Could not fetch CLI release metadata from api.github.com. A 401 means github_token isn't valid for github.com; a 403 usually means the anonymous rate limit. Set github_token to a github.com token, such as a fine-grained personal access token with no permissions."
+    return 1
+  fi
 }
 
 release_asset_url() {
diff --git a/tests/install.test.sh b/tests/install.test.sh
index 7d62a0f..8a0c1b6 100644
--- a/tests/install.test.sh
+++ b/tests/install.test.sh
@@ -174,6 +174,17 @@ test_invalid_metadata() {
   assert_not_installed
 }
 
+test_metadata_fetch_failure() {
+  new_case "metadata-fetch-failure"
+  printf 'verified-binary\n' >"$MOCK_BINARY"
+  : >"$MOCK_CHECKSUMS"
+  write_release "v0.17.0" true "linear-release-linux-x64" true
+  MOCK_CURL_FAIL_PATTERN="api.github.com" invoke_installer "v0.17.0" "Linux" "x86_64"
+  assert_failure
+  assert_contains "${CASE_DIR}/output.log" "Set github_token to a github.com token"
+  assert_not_installed
+}
+
 test_unsupported_platform() {
   new_case "unsupported-platform"
   printf 'binary\n' >"$MOCK_BINARY"
@@ -194,6 +205,7 @@ tests=(
   test_verified_release
   test_tampered_release
   test_invalid_metadata
+  test_metadata_fetch_failure
   test_unsupported_platform
 )