diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c6a33b8d..c21dbc00e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - Fixed `GET /api/mcp` hanging with zero bytes by returning `405 Method Not Allowed` per the MCP Streamable HTTP spec [#1064](https://github.com/sourcebot-dev/sourcebot/pull/1064)
+- Fixed tokens with trailing newlines breaking git clone URLs by adding `.trim()` in `getTokenFromConfig()` [#1067](https://github.com/sourcebot-dev/sourcebot/pull/1067)
 
 ### Removed
 - Removed "general" settings page with options to change organization name and domain. [#1065](https://github.com/sourcebot-dev/sourcebot/pull/1065)
diff --git a/packages/shared/src/crypto.ts b/packages/shared/src/crypto.ts
index f542ece45..ae2aa423c 100644
--- a/packages/shared/src/crypto.ts
+++ b/packages/shared/src/crypto.ts
@@ -107,7 +107,7 @@ export const getTokenFromConfig = async (token: Token): Promise<string> => {
             throw new Error(`Environment variable ${token.env} not found.`);
         }
 
-        return envToken;
+        return envToken.trim();
     } else if ('googleCloudSecret' in token) {
         try {
             const client = new SecretManagerServiceClient();
@@ -119,7 +119,7 @@ export const getTokenFromConfig = async (token: Token): Promise<string> => {
                 throw new Error(`Secret ${token.googleCloudSecret} not found.`);
             }
 
-            return response.payload.data.toString();
+            return response.payload.data.toString().trim();
         } catch (error) {
             throw new Error(`Failed to access Google Cloud secret ${token.googleCloudSecret}: ${error instanceof Error ? error.message : String(error)}`);
         }