diff --git a/.devcontainer/setup.sh b/.devcontainer/setup.sh
index 6cf642d..e9eca45 100644
--- a/.devcontainer/setup.sh
+++ b/.devcontainer/setup.sh
@@ -96,6 +96,18 @@ echo "--- Syncing canonical flows ---"
 cd "$REPO/backend"
 as_vscode "uv run python scripts/sync_flows.py --sync" || echo "WARN: flow sync failed (check backend/flows and LFX)"
 
+# Git Credential Manager (GCM) for HTTPS git auth inside the container.
+# Tokens are stored in GCM's encrypted store (not in URLs or plain text).
+# First-run device-code prompt appears on first git op; open the printed
+# URL on the host to complete auth.
+echo "--- Installing Git Credential Manager ---"
+GCM_DEB_URL="https://github.com/git-ecosystem/git-credential-manager/releases/download/v2.9.1/gcm-linux-x64-2.9.1.deb"
+GCM_DEB="/tmp/gcm-linux-x64-2.9.1.deb"
+curl -fsSL "$GCM_DEB_URL" -o "$GCM_DEB"
+dpkg -i "$GCM_DEB" 2>/dev/null || apt-get install -f -y
+as_vscode "git config --global credential.helper manager"
+rm -f "$GCM_DEB"
+
 echo ""
 echo "=== Setup complete ==="
 echo "Forgejo username: $FORGEJO_USERNAME"