diff --git a/.github/workflows/openclaw-release-checks.yml b/.github/workflows/openclaw-release-checks.yml
index 1df3f576a828..085ef39e1b58 100644
--- a/.github/workflows/openclaw-release-checks.yml
+++ b/.github/workflows/openclaw-release-checks.yml
@@ -228,13 +228,13 @@ jobs:
           set -euo pipefail
           SELECTED_SHA="$(git rev-parse HEAD)"
           git_fetch_with_checkout_auth() {
-            if git config --get-all http.https://github.com/.extraheader >/dev/null; then
-              git fetch "$@"
-              return
+            local -a git_args=(git)
+            if ! git config --get-all http.https://github.com/.extraheader >/dev/null; then
+              local auth_header
+              auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
+              git_args+=(-c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}")
             fi
-            local auth_header
-            auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
-            git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch "$@"
+            timeout --signal=TERM --kill-after=10s 120s "${git_args[@]}" fetch "$@"
           }
           git_fetch_with_checkout_auth --no-tags origin '+refs/heads/*:refs/remotes/origin/*'
           git_fetch_with_checkout_auth --tags origin '+refs/tags/*:refs/tags/*'
@@ -289,13 +289,13 @@ jobs:
           fi
           alpha_branch="${WORKFLOW_REF#refs/heads/}"
           git_fetch_with_checkout_auth() {
-            if git config --get-all http.https://github.com/.extraheader >/dev/null; then
-              git fetch "$@"
-              return
+            local -a git_args=(git)
+            if ! git config --get-all http.https://github.com/.extraheader >/dev/null; then
+              local auth_header
+              auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
+              git_args+=(-c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}")
             fi
-            local auth_header
-            auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
-            git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch "$@"
+            timeout --signal=TERM --kill-after=10s 120s "${git_args[@]}" fetch "$@"
           }
           git_fetch_with_checkout_auth --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
           if ! git merge-base --is-ancestor "${SELECTED_SHA}" "refs/remotes/origin/${alpha_branch}"; then
diff --git a/test/scripts/ci-workflow-guards.test.ts b/test/scripts/ci-workflow-guards.test.ts
index 1cd23f6e573d..78962cd6afb6 100644
--- a/test/scripts/ci-workflow-guards.test.ts
+++ b/test/scripts/ci-workflow-guards.test.ts
@@ -2946,6 +2946,28 @@ describe("ci workflow guards", () => {
     }
   });
 
+  it("bounds release ref validation fetches across checkout auth modes", () => {
+    const resolveTargetSteps = readReleaseChecksWorkflow().jobs.resolve_target.steps;
+
+    for (const stepName of [
+      "Validate selected ref belongs to this repository",
+      "Validate Tideclaw alpha target matches workflow branch",
+    ]) {
+      const step = resolveTargetSteps.find(
+        (candidate: WorkflowStep) => candidate.name === stepName,
+      );
+
+      expect(step?.run, stepName).toContain("local -a git_args=(git)");
+      expect(step?.run, stepName).toContain(
+        'git_args+=(-c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}")',
+      );
+      expect(step?.run, stepName).toContain(
+        'timeout --signal=TERM --kill-after=10s 120s "${git_args[@]}" fetch "$@"',
+      );
+      expect(step?.run, stepName).not.toContain('git -c "http.https://github.com/.extraheader');
+    }
+  });
+
   it("bounds shared base commit fetches", () => {
     const action = readFileSync(".github/actions/ensure-base-commit/action.yml", "utf8");
     const exactFetch = action.indexOf('fetch_base_ref --no-tags --depth=1 origin "$BASE_SHA"');