diff --git a/.github/workflows/chipyard-gpu-flow.yml b/.github/workflows/chipyard-gpu-flow.yml
index 4b776b92..210ef42a 100644
--- a/.github/workflows/chipyard-gpu-flow.yml
+++ b/.github/workflows/chipyard-gpu-flow.yml
@@ -12,6 +12,7 @@ defaults:
 env:
   REMOTE_WORK_DIR: ${{ secrets.BUILDDIR }}/cy-ci-shared/cy-${{ github.sha }}
   JAVA_TMP_DIR: /tmp/cy-${{ github.sha }}-full
+  SSH_AUTH_SOCK: /tmp/ssh_agent_github.sock
   MAKEFLAGS: "-j32"
 
 jobs:
@@ -69,6 +70,12 @@ jobs:
             rm -rf ${{ github.workspace }}/* || true
             rm -rf ${{ github.workspace }}/.* || true
             ls -alh .
+      # note: the agent spun up here will be made available throughout the
+      # workflow via env.SSH_AUTH_SOCK.
+      - name: Run ssh-agent
+        run: |
+            eval `ssh-agent -a $SSH_AUTH_SOCK -s`
+            echo "${{ secrets.PRIVATE_SSH_KEY }}" | ssh-add -
       - uses: actions/checkout@v3
       - name: Setup repo copy
         run: |