diff --git a/README.adoc b/README.adoc
index 1da74fee61..e9320f7d55 100644
--- a/README.adoc
+++ b/README.adoc
@@ -60,6 +60,23 @@ Check the open docs issues. If you find an issue you'd like to work on:
 - If the issue is already assigned to someone else, please consider another one.
 - If the issue is unassigned, add a comment expressing your interest in working on it.
 
+== Set up GitHub authentication
+
+The Antora playbook in this repository fetches content from other GitHub repositories, including the private `cloud-docs` and `rp-connect-docs` repositories and this repository's own versioned branches, so building the site requires a GitHub token, even for read-only builds.
+
+IMPORTANT: Antora does not use git credential helpers (such as the `gh` CLI helper or the macOS keychain), so you must complete this step even if `git clone` already works on your machine. By default, Antora reads credentials from the `GIT_CREDENTIALS` environment variable or the `~/.git-credentials` file (with a fallback to `$XDG_CONFIG_HOME/git/credentials`).
+
+If you aren't already signed in to the https://cli.github.com[GitHub CLI^], run `gh auth login` first. Then store credentials one time:
+
+```bash
+echo "https://$(gh auth token):@github.com" >> ~/.git-credentials
+chmod 600 ~/.git-credentials
+```
+
+If you don't use the GitHub CLI, https://github.com/settings/personal-access-tokens/new[create a fine-grained personal access token^]: select `redpanda-data` as the resource owner, grant the token access to the private doc repositories, and set the `Contents` permission to read-only. Use the token in place of `$(gh auth token)`. Organization approval may be required before the token becomes active.
+
+NOTE: Tokens from `gh auth token` rotate when you sign in to the GitHub CLI again. If Antora builds start failing with `401` or `404` errors on remote content sources, remove the stale `github.com` line from `~/.git-credentials` and re-run the setup command.
+
 == Local development
 
 If you want to run the website locally, install and update the packages: