diff --git a/build/azure-pipelines/darwin/continuous-build-darwin.yml b/build/azure-pipelines/darwin/continuous-build-darwin.yml
index fea2d90f0b..644df32491 100644
--- a/build/azure-pipelines/darwin/continuous-build-darwin.yml
+++ b/build/azure-pipelines/darwin/continuous-build-darwin.yml
@@ -7,6 +7,12 @@ steps:
     keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock, !samples/**/yarn.lock'
     targetfolder: '**/node_modules, !**/node_modules/**/node_modules, !samples/**/node_modules'
     vstsFeed: '$(build-cache)' # {{SQL CARBON EDIT}} update build cache
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'azuredatastudio-adointegration'
+    KeyVaultName: ado-secrets
+    SecretsFilter: 'github-distro-mixin-password'
 - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@3 # {{SQL CARBON EDIT}} update version
   inputs:
     versionSpec: "1.x"
@@ -15,7 +21,7 @@ steps:
   displayName: Install Dependencies
   condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
   env:
-    GITHUB_TOKEN: $(GITHUB_TOKEN) # {{SQL CARBON EDIT}} add github token
+    GITHUB_TOKEN: $(github-distro-mixin-password) # {{SQL CARBON EDIT}} add github token
 - task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
   inputs:
     keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock, !samples/**/yarn.lock'
@@ -26,7 +32,7 @@ steps:
     yarn electron x64
   displayName: Download Electron
   env:
-    GITHUB_TOKEN: $(GITHUB_TOKEN) # {{SQL CARBON EDIT}} add github token
+    GITHUB_TOKEN: $(github-distro-mixin-password) # {{SQL CARBON EDIT}} add github token
 - script: |
     yarn gulp hygiene --skip-tslint
   displayName: Run Hygiene Checks
diff --git a/build/azure-pipelines/darwin/sql-product-build-darwin.yml b/build/azure-pipelines/darwin/sql-product-build-darwin.yml
index f1874fb064..857d1b0b16 100644
--- a/build/azure-pipelines/darwin/sql-product-build-darwin.yml
+++ b/build/azure-pipelines/darwin/sql-product-build-darwin.yml
@@ -18,6 +18,7 @@ steps:
     inputs:
       azureSubscription: 'ClientToolsInfra_670062 (88d5392f-a34f-4769-b405-f597fc533613)'
       KeyVaultName: ado-secrets
+      SecretsFilter: 'github-distro-mixin-password'
 
   - script: |
       set -e
diff --git a/build/azure-pipelines/linux/continuous-build-linux.yml b/build/azure-pipelines/linux/continuous-build-linux.yml
index 4ad19ca4c2..94c1b0fb12 100644
--- a/build/azure-pipelines/linux/continuous-build-linux.yml
+++ b/build/azure-pipelines/linux/continuous-build-linux.yml
@@ -15,6 +15,12 @@ steps:
     keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock, !samples/**/yarn.lock'
     targetfolder: '**/node_modules, !**/node_modules/**/node_modules, !samples/**/node_modules'
     vstsFeed: '$(build-cache)' # {{SQL CARBON EDIT}} update build cache
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'azuredatastudio-adointegration'
+    KeyVaultName: ado-secrets
+    SecretsFilter: 'github-distro-mixin-password'
 - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@3 # {{SQL CARBON EDIT}} update version
   inputs:
     versionSpec: "1.x"
@@ -23,7 +29,7 @@ steps:
   displayName: Install Dependencies
   condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
   env:
-    GITHUB_TOKEN: $(GITHUB_TOKEN)  # {{SQL CARBON EDIT}} add github token
+    GITHUB_TOKEN: $(github-distro-mixin-password)  # {{SQL CARBON EDIT}} add github token
 - task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
   inputs:
     keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock, !samples/**/yarn.lock'
@@ -34,7 +40,7 @@ steps:
     yarn electron x64
   displayName: Download Electron
   env:
-    GITHUB_TOKEN: $(GITHUB_TOKEN) # {{SQL CARBON EDIT}} add github token
+    GITHUB_TOKEN: $(github-distro-mixin-password) # {{SQL CARBON EDIT}} add github token
 - script: |
     yarn gulp hygiene --skip-tslint
   displayName: Run Hygiene Checks
diff --git a/build/azure-pipelines/linux/sql-product-build-linux.yml b/build/azure-pipelines/linux/sql-product-build-linux.yml
index 9dd4bda5ed..b256b0b171 100644
--- a/build/azure-pipelines/linux/sql-product-build-linux.yml
+++ b/build/azure-pipelines/linux/sql-product-build-linux.yml
@@ -22,6 +22,7 @@ steps:
     inputs:
       azureSubscription: 'ClientToolsInfra_670062 (88d5392f-a34f-4769-b405-f597fc533613)'
       KeyVaultName: ado-secrets
+      SecretsFilter: 'github-distro-mixin-password'
 
   - script: |
       set -e
diff --git a/build/azure-pipelines/win32/continuous-build-win32.yml b/build/azure-pipelines/win32/continuous-build-win32.yml
index 3b46d8368b..c2c9b3b816 100644
--- a/build/azure-pipelines/win32/continuous-build-win32.yml
+++ b/build/azure-pipelines/win32/continuous-build-win32.yml
@@ -9,6 +9,12 @@ steps:
   inputs:
     versionSpec: '2.x'
     addToPath: true
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'azuredatastudio-adointegration'
+    KeyVaultName: ado-secrets
+    SecretsFilter: 'github-distro-mixin-password'
 - task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
   inputs:
     keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock, !samples/**/yarn.lock'
@@ -18,7 +24,7 @@ steps:
     yarn --frozen-lockfile
   env:
     CHILD_CONCURRENCY: "1"
-    GITHUB_TOKEN: $(GITHUB_TOKEN) # {{SQL CARBON EDIT}} add github token
+    GITHUB_TOKEN: $(github-distro-mixin-password) # {{SQL CARBON EDIT}} add github token
   displayName: Install Dependencies
   condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
 - task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
@@ -30,7 +36,7 @@ steps:
 - powershell: |
     yarn electron
   env:
-    GITHUB_TOKEN: $(GITHUB_TOKEN) # {{SQL CARBON EDIT}} add github token
+    GITHUB_TOKEN: $(github-distro-mixin-password) # {{SQL CARBON EDIT}} add github token
 - script: |
     yarn gulp hygiene --skip-tslint
   displayName: Run Hygiene Checks
diff --git a/build/azure-pipelines/win32/sql-product-build-win32.yml b/build/azure-pipelines/win32/sql-product-build-win32.yml
index 1c002d8d23..ba3b308439 100644
--- a/build/azure-pipelines/win32/sql-product-build-win32.yml
+++ b/build/azure-pipelines/win32/sql-product-build-win32.yml
@@ -21,6 +21,7 @@ steps:
     inputs:
       azureSubscription: 'ClientToolsInfra_670062 (88d5392f-a34f-4769-b405-f597fc533613)'
       KeyVaultName: ado-secrets
+      SecretsFilter: 'github-distro-mixin-password'
 
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1