diff --git a/files/bec_bl_push_pat b/files/bec_bl_push_pat
new file mode 100644
index 0000000..66f5735
--- /dev/null
+++ b/files/bec_bl_push_pat
@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+65336536396436353335343337346663363632346439343565363839616137363065643635366335
+6364666231373730303838333037373137663536663836330a656633323334303163626133643732
+34316136356436653936366433653435383032306330333338636666396339376335663534633339
+3166326532303366300a666431653132303031336436316665653332366663613966363833636365
+63366262346337303066633830326664393832623338383439363739303062613039373665363063
+3137663565313232616239383566653236653862626334353131
diff --git a/tasks/main.yaml b/tasks/main.yaml
index dec2ff0..cadc3a1 100644
--- a/tasks/main.yaml
+++ b/tasks/main.yaml
@@ -173,20 +173,12 @@
 - name: Clone BEC plugins
   become_user: "{{ deployment_user }}"
   ansible.builtin.git:
-    repo: https://git:{{ lookup('env', 'BEC_PLUGIN_TOKEN') }}@gitea.psi.ch/bec/{{ item.key }}.git
+    repo: https://git:{{ bec_bl_push_pat }}@gitea.psi.ch/bec/{{ item.key }}.git
     dest: "{{ timestamped_deployment_path }}/{{ item.key }}"
     version: "{{ item.value or 'main' }}"
   loop: "{{ bec_plugins | dict2items }}"
   when: not ansible_check_mode
 
-- name: Clear token from git remote url in BEC plugins
-  become_user: "{{ deployment_user }}"
-  ansible.builtin.command:
-    cmd: git remote set-url origin https://gitea.psi.ch/bec/{{ item.key }}.git
-    chdir: "{{ timestamped_deployment_path }}/{{ item.key }}"
-  loop: "{{ bec_plugins | dict2items }}"
-  when: not ansible_check_mode
-
 - name: Create user branches in git repositories of plugins
   become_user: "{{ deployment_user }}"
   ansible.builtin.command:
diff --git a/vars/main.yaml b/vars/main.yaml
index f39f975..8008319 100644
--- a/vars/main.yaml
+++ b/vars/main.yaml
@@ -5,3 +5,4 @@ timestamped_deployment_path: "{{ deployment_path }}/{{ ansible_date_time['iso860
 bec_venv_path: "{{ timestamped_deployment_path }}/bec_venv"
 user_git_branch_name: "{{ git_username }}_{{ deployment_name }}_{{ ansible_date_time['iso8601_basic_short'] }}"
 bec_atlas_token: "{{ lookup('file', 'bec_atlas_token') }}"
+bec_bl_push_pat: "{{ lookup('file', 'bec_bl_push_pat') }}"