diff --git a/.gitignore b/.gitignore
index 92ebe6e..fd7f403 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,7 +3,6 @@ __pycache__/
 .pytest_cache/
 .ruff_cache/
 /.codex
-/profile/cache/bazel_registry_checkout/
-/profile/cache/reference_integration_checkout/
+/profile/cache/
 /.cache
 /_site/
diff --git a/docs/repo-overview/architecture.md b/docs/repo-overview/architecture.md
index d2b5abf..e2ea8a0 100644
--- a/docs/repo-overview/architecture.md
+++ b/docs/repo-overview/architecture.md
@@ -53,7 +53,8 @@ rather than Markdown- or HTML-specific values.
 - `collector/signal_detection.py` derives repository-local content signals.
 - `collector/platform_docs.py` discovers and associates platform Sphinx
   declarations after repository collection.
-- `collector/git_checkout.py` owns shallow checkout synchronization and reads.
+- `collector/git_checkout.py` delegates checkout synchronization to the shared
+  `repo_cache` package and provides repository reads and release-ref helpers.
 - `collector/snapshot_io.py` serializes the normalized snapshot.
 - `models.py` defines the collection/rendering boundary.
 - `profile_readme.py` renders the organization profile.
diff --git a/docs/repo-overview/collection-and-cache.md b/docs/repo-overview/collection-and-cache.md
index 5d9a709..e491e89 100644
--- a/docs/repo-overview/collection-and-cache.md
+++ b/docs/repo-overview/collection-and-cache.md
@@ -3,7 +3,7 @@
 ## Snapshot Cache
 
 The default cache file is `.cache/repo_overview.json`.
-Repository checkouts share the SCORE repository-policy cache:
+Repository checkouts share the SCORE `repo_cache` cache:
 `${XDG_CACHE_HOME:-~/.cache}/repo-cache/<owner>/<repository>`.
 
 The cache is used in two ways:
@@ -17,8 +17,9 @@ Changing a renderer or template therefore requires no GitHub refresh.
 ## Incremental Collection
 
 Collection still fetches current high-level repository state, including the
-default branch. Git synchronizes each shallow partial checkout and supplies the
-current commit SHA. The collector then chooses one of these paths:
+default branch. The shared `repo_cache` package synchronizes each shallow
+checkout through the authenticated GitHub CLI and supplies the current commit
+SHA. The collector then chooses one of these paths:
 
 - unchanged SHA and fresh volatile metrics: reuse the cached repository entry
 - unchanged SHA and stale volatile metrics: refresh activity metrics only
@@ -50,10 +51,10 @@ Git supplies repository content and identity:
 - Bazel and Sphinx declarations
 - release `MODULE.bazel` and `.bazelversion`
 
-Checkouts are disposable, shallow, single-branch partial clones. The generic
-cache is shared with other repository tools such as `score-repo-policy-sync`.
-Authentication is passed through a transient Git HTTP header and is not written
-into the remote URL.
+Checkouts are disposable, shallow, single-branch clones. The cache is shared
+with other repository tools such as `score-repo-policy-sync` and
+`score-repo-cache`. Checkout authentication is handled by `gh`; use
+`GITHUB_TOKEN` or `gh auth login` before collecting.
 
 For a repository without any commits, GitHub may report a default-branch name
 even though that branch cannot be resolved. After a failed checkout, the
diff --git a/docs/repo-overview/usage-and-extension.md b/docs/repo-overview/usage-and-extension.md
index 21248c3..0136fae 100644
--- a/docs/repo-overview/usage-and-extension.md
+++ b/docs/repo-overview/usage-and-extension.md
@@ -37,6 +37,8 @@ uv sync --all-groups --frozen
 
 Collection reads `GITHUB_TOKEN` and falls back to `gh auth token`. The token
 must be able to read every configured organization and platform repository.
+The shared `repo_cache` dependency uses the authenticated `gh` CLI for Git
+checkout synchronization; a custom `--token-env` value is forwarded to it.
 The policy report fetch uses `GH_TOKEN`/`GITHUB_TOKEN` through the installed
 GitHub CLI (`gh auth login` is sufficient for local use).
 
diff --git a/pyproject.toml b/pyproject.toml
index 2c3f26b..32ded9b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -9,6 +9,7 @@ description = "Collect cached GitHub organization overviews and render Markdown
 requires-python = ">=3.12"
 dependencies = [
   "PyGithub",
+  "repo-cache @ git+https://github.com/eclipse-score/tools#subdirectory=repo_cache",
   "tqdm",
 ]
 
@@ -26,6 +27,9 @@ dev = [
 [tool.hatch.build.targets.wheel]
 packages = ["src/generate_repo_overview"]
 
+[tool.hatch.metadata]
+allow-direct-references = true
+
 [tool.uv]
 package = true
 
diff --git a/src/generate_repo_overview/collector/__init__.py b/src/generate_repo_overview/collector/__init__.py
index 781d390..ef370a8 100644
--- a/src/generate_repo_overview/collector/__init__.py
+++ b/src/generate_repo_overview/collector/__init__.py
@@ -170,6 +170,11 @@ def collect_snapshot(
         when="before collection",
         status_prefix=status_prefix,
     )
+    # repo_cache starts gh subprocesses for checkout synchronization.  GH_TOKEN
+    # gives those subprocesses the same credential used by PyGithub, including
+    # when the caller selected a custom --token-env variable.
+    previous_gh_token = os.environ.get("GH_TOKEN")
+    os.environ["GH_TOKEN"] = token
     try:
         organization = github.get_organization(org_name)
 
@@ -197,7 +202,6 @@ def collect_snapshot(
             repos,
             github=github,
             platform_repos=config.platform_repos,
-            github_token=token,
             status_prefix=status_prefix,
         )
 
@@ -228,6 +232,10 @@ def collect_snapshot(
             print_status(f"Wrote snapshot to {cache_path}", prefix=status_prefix)
         return snapshot
     finally:
+        if previous_gh_token is None:
+            os.environ.pop("GH_TOKEN", None)
+        else:
+            os.environ["GH_TOKEN"] = previous_gh_token
         print_rest_api_rate_limit(
             github,
             when="after collection",
@@ -240,7 +248,6 @@ def enrich_repositories_with_platform_docs(
     *,
     github: RepositoryResolverLike,
     platform_repos: tuple[str, ...],
-    github_token: str | None = None,
     status_prefix: str,
 ) -> list[RepoEntry]:
     enriched = [
@@ -260,16 +267,14 @@ def enrich_repositories_with_platform_docs(
             prefix=status_prefix,
         )
         repository = github.get_repo(full_name)
-        clone_url = cast("str | None", getattr(repository, "clone_url", None))
         default_branch = cast("str | None", getattr(repository, "default_branch", None))
-        if clone_url is None or default_branch is None:
+        if default_branch is None:
             raise RuntimeError(
-                f"Configured platform repository {full_name} has no clone metadata."
+                f"Configured platform repository {full_name} has no default branch."
             )
         checkout_path = sync_repository_checkout(
-            clone_url=clone_url,
+            repository=full_name,
             default_branch=default_branch,
-            github_token=github_token,
             checkout_path=DEFAULT_REPOSITORY_CHECKOUTS / full_name,
         )
         if checkout_path is None:
@@ -360,6 +365,10 @@ def fetch_repositories(
         f"{repositories_with_custom_properties} repositories",
         prefix=status_prefix,
     )
+    resolved_registry_repository = cast(
+        "str | None", getattr(registry_repository, "full_name", None)
+    )
+    registry_repository_name = resolved_registry_repository or config.registry_repo
 
     bazel_registry_metadata_by_repo: dict[
         str, registry_metadata.RegistrySignalsPayload
@@ -373,7 +382,6 @@ def fetch_repositories(
             registry_metadata.fetch_bazel_registry_metadata_by_repo(
                 bazel_registry_repository=registry_repository,
                 active_repository_names=set(active_repositories),
-                github_token=github_token,
             )
         )
         print_status(
@@ -398,7 +406,7 @@ def fetch_repositories(
                     else None
                 ),
                 active_repository_names=set(active_repositories),
-                github_token=github_token,
+                registry_repository=registry_repository_name,
                 org_name=config.org_name,
             )
         )
diff --git a/src/generate_repo_overview/collector/git_checkout.py b/src/generate_repo_overview/collector/git_checkout.py
index ff61825..cb4743d 100644
--- a/src/generate_repo_overview/collector/git_checkout.py
+++ b/src/generate_repo_overview/collector/git_checkout.py
@@ -2,109 +2,33 @@
 
 import base64
 import os
-import shutil
 import subprocess
 from typing import TYPE_CHECKING
 
+from repo_cache import RepoCacheError, sync_default_branch
+
 if TYPE_CHECKING:
     from pathlib import Path
 
 
 def sync_repository_checkout(
     *,
-    clone_url: str,
+    repository: str,
     default_branch: str,
-    github_token: str | None,
     checkout_path: Path,
 ) -> Path | None:
-    authenticated_url = build_authenticated_clone_url(clone_url, github_token)
-    checkout_path.parent.mkdir(parents=True, exist_ok=True)
-
-    if update_existing_checkout(
-        checkout_path,
-        default_branch,
-        github_token=github_token,
-    ):
-        return checkout_path
-
-    if not clone_fresh_checkout(
-        authenticated_url=authenticated_url,
-        default_branch=default_branch,
-        checkout_path=checkout_path,
-        github_token=github_token,
-    ):
+    """Synchronize a GitHub checkout through the shared ``repo_cache`` package."""
+    try:
+        sync_default_branch(
+            repository=repository,
+            branch=default_branch,
+            destination=checkout_path,
+        )
+    except (OSError, RepoCacheError):
         return None
-
     return checkout_path
 
 
-def update_existing_checkout(
-    checkout_path: Path,
-    default_branch: str,
-    *,
-    github_token: str | None = None,
-) -> bool:
-    git_dir = checkout_path / ".git"
-    if not git_dir.exists():
-        return False
-
-    fetch_ok = run_git_command(
-        [
-            "git",
-            "-C",
-            str(checkout_path),
-            "fetch",
-            "--depth",
-            "1",
-            "origin",
-            default_branch,
-        ],
-        github_token=github_token,
-    )
-    checkout_ok = run_git_command(
-        [
-            "git",
-            "-C",
-            str(checkout_path),
-            "checkout",
-            "--force",
-            "--detach",
-            "FETCH_HEAD",
-        ]
-    )
-    if not (fetch_ok and checkout_ok):
-        return False
-
-    run_git_command(["git", "-C", str(checkout_path), "clean", "-fdx"])
-    return True
-
-
-def clone_fresh_checkout(
-    *,
-    authenticated_url: str,
-    default_branch: str,
-    checkout_path: Path,
-    github_token: str | None = None,
-) -> bool:
-    shutil.rmtree(checkout_path, ignore_errors=True)
-    return run_git_command(
-        [
-            "git",
-            "clone",
-            "--depth",
-            "1",
-            "--filter=blob:none",
-            "--single-branch",
-            "--no-tags",
-            "--branch",
-            default_branch,
-            authenticated_url,
-            str(checkout_path),
-        ],
-        github_token=github_token,
-    )
-
-
 def get_checkout_head_sha(checkout_path: Path) -> str | None:
     try:
         result = subprocess.run(
@@ -215,10 +139,6 @@ def run_git_command(
     return True
 
 
-def build_authenticated_clone_url(clone_url: str, github_token: str | None) -> str:
-    return clone_url
-
-
 def _run_git_for_text(command: list[str]) -> str | None:
     try:
         result = subprocess.run(
diff --git a/src/generate_repo_overview/collector/reference_integration.py b/src/generate_repo_overview/collector/reference_integration.py
index debe9f5..7244d6f 100644
--- a/src/generate_repo_overview/collector/reference_integration.py
+++ b/src/generate_repo_overview/collector/reference_integration.py
@@ -5,19 +5,17 @@
 from typing import TYPE_CHECKING, cast
 from urllib.parse import urlsplit
 
+from repo_cache import default_cache_directory
+
+from generate_repo_overview.org_config import is_safe_repository_path
+
 from .git_checkout import sync_repository_checkout
-from .registry_metadata import (
-    BAZEL_REGISTRY_LOCAL_CHECKOUT,
-    parse_bazel_registry_metadata,
-)
+from .registry_metadata import parse_bazel_registry_metadata
 from .signal_detection import dedupe_preserving_order
 
 if TYPE_CHECKING:
     from collections.abc import Iterable
 
-REFERENCE_INTEGRATION_LOCAL_CHECKOUT = Path(
-    "profile/cache/reference_integration_checkout"
-)
 ROOT_MODULE_PATH = Path("MODULE.bazel")
 INCLUDE_PATTERN = re.compile(r'\binclude\s*\(\s*"(?P<label>[^"]+)"\s*\)')
 BAZEL_DEP_PATTERN = re.compile(r"\bbazel_dep\s*\((?P<body>.*?)\)", re.DOTALL)
@@ -31,7 +29,7 @@ def fetch_reference_integration_repository_names(
     *,
     reference_integration_repository: object | None,
     active_repository_names: set[str],
-    github_token: str | None,
+    registry_repository: str,
     org_name: str,
 ) -> set[str]:
     if reference_integration_repository is None:
@@ -41,17 +39,16 @@ def fetch_reference_integration_repository_names(
         "str | None",
         getattr(reference_integration_repository, "default_branch", None),
     )
-    clone_url = cast(
-        "str | None", getattr(reference_integration_repository, "clone_url", None)
+    repository = cast(
+        "str | None", getattr(reference_integration_repository, "full_name", None)
     )
-    if default_branch is None or clone_url is None:
+    if default_branch is None or repository is None:
         return set()
 
     checkout_path = sync_repository_checkout(
-        clone_url=clone_url,
+        repository=repository,
         default_branch=default_branch,
-        github_token=github_token,
-        checkout_path=REFERENCE_INTEGRATION_LOCAL_CHECKOUT,
+        checkout_path=default_cache_directory() / repository,
     )
     if checkout_path is None:
         return set()
@@ -65,6 +62,7 @@ def fetch_reference_integration_repository_names(
     )
     registry_repositories = get_bazel_registry_repositories_by_module(
         active_repository_names=active_repository_names,
+        registry_repository=registry_repository,
     )
 
     repositories: list[str] = []
@@ -240,10 +238,16 @@ def parse_github_remote_repository_name(
 def get_bazel_registry_repositories_by_module(
     *,
     active_repository_names: set[str],
+    registry_repository: str,
 ) -> dict[str, str]:
+    if not is_safe_repository_path(registry_repository):
+        return {}
+
     repositories_by_module: dict[str, str] = {}
     for metadata_path in sorted(
-        BAZEL_REGISTRY_LOCAL_CHECKOUT.glob("modules/*/metadata.json")
+        (default_cache_directory() / registry_repository).glob(
+            "modules/*/metadata.json"
+        )
     ):
         try:
             content = metadata_path.read_text(encoding="utf-8")
diff --git a/src/generate_repo_overview/collector/registry_metadata.py b/src/generate_repo_overview/collector/registry_metadata.py
index 0a91b3b..6572fc5 100644
--- a/src/generate_repo_overview/collector/registry_metadata.py
+++ b/src/generate_repo_overview/collector/registry_metadata.py
@@ -1,9 +1,10 @@
 from __future__ import annotations
 
 import json
-from pathlib import Path
 from typing import TypedDict, cast
 
+from repo_cache import default_cache_directory
+
 from .git_checkout import sync_repository_checkout
 from .signal_detection import dedupe_preserving_order
 
@@ -13,14 +14,10 @@ class RegistrySignalsPayload(TypedDict):
     latest_bazel_registry_version: str | None
 
 
-BAZEL_REGISTRY_LOCAL_CHECKOUT = Path("profile/cache/bazel_registry_checkout")
-
-
 def fetch_bazel_registry_metadata_by_repo(
     *,
     bazel_registry_repository: object | None,
     active_repository_names: set[str],
-    github_token: str | None,
 ) -> dict[str, RegistrySignalsPayload]:
     if bazel_registry_repository is None:
         return {}
@@ -28,17 +25,16 @@ def fetch_bazel_registry_metadata_by_repo(
     default_branch = cast(
         "str | None", getattr(bazel_registry_repository, "default_branch", None)
     )
-    clone_url = cast(
-        "str | None", getattr(bazel_registry_repository, "clone_url", None)
+    repository = cast(
+        "str | None", getattr(bazel_registry_repository, "full_name", None)
     )
-    if default_branch is None or clone_url is None:
+    if default_branch is None or repository is None:
         return {}
 
     checkout_path = sync_repository_checkout(
-        clone_url=clone_url,
+        repository=repository,
         default_branch=default_branch,
-        github_token=github_token,
-        checkout_path=BAZEL_REGISTRY_LOCAL_CHECKOUT,
+        checkout_path=default_cache_directory() / repository,
     )
     if checkout_path is None:
         return {}
diff --git a/src/generate_repo_overview/collector/repo_entry.py b/src/generate_repo_overview/collector/repo_entry.py
index cb66322..7a42d1e 100644
--- a/src/generate_repo_overview/collector/repo_entry.py
+++ b/src/generate_repo_overview/collector/repo_entry.py
@@ -267,10 +267,8 @@ def collect_repository_entry_slow_path(
         or content_signals["bazel_lockfile_status"] == LockfileStatus.UNKNOWN
     ):
         lockfile_status, lockfile_error = _detect_lockfile_ok_for_repo(
-            repository_name=repository_name,
             repository=repository,
             default_branch=default_branch,
-            github_token=github_token,
             checkout_path=checkout_path,
         )
         content_signals["bazel_lockfile_status"] = lockfile_status
@@ -315,11 +313,12 @@ def _sync_content_checkout(
         return (None, get_default_branch_sha(repository, default_branch))
 
     full_name = cast("str | None", getattr(repository, "full_name", None))
-    checkout_path = DEFAULT_REPOSITORY_CHECKOUTS / (full_name or repository_name)
+    if full_name is None:
+        return (None, get_default_branch_sha(repository, default_branch))
+    checkout_path = DEFAULT_REPOSITORY_CHECKOUTS / full_name
     synced = sync_repository_checkout(
-        clone_url=clone_url,
+        repository=full_name,
         default_branch=default_branch,
-        github_token=github_token,
         checkout_path=checkout_path,
     )
     if synced is None:
@@ -351,22 +350,21 @@ def _sync_content_checkout(
 
 def _detect_lockfile_ok_for_repo(
     *,
-    repository_name: str,
     repository: Any,
     default_branch: str | None,
-    github_token: str | None,
     checkout_path: Path | None = None,
 ) -> tuple[LockfileStatus, str | None]:
     if checkout_path is not None:
         return detect_bazel_lockfile_ok(checkout_path)
-    clone_url = cast("str | None", getattr(repository, "clone_url", None))
-    if clone_url is None or default_branch is None:
+    if default_branch is None:
         return LockfileStatus.UNKNOWN, None
-    checkout_path = DEFAULT_REPOSITORY_CHECKOUTS / repository_name
+    repository_identity = cast("str | None", getattr(repository, "full_name", None))
+    if repository_identity is None:
+        return LockfileStatus.UNKNOWN, None
+    checkout_path = DEFAULT_REPOSITORY_CHECKOUTS / repository_identity
     synced = sync_repository_checkout(
-        clone_url=clone_url,
+        repository=repository_identity,
         default_branch=default_branch,
-        github_token=github_token,
         checkout_path=checkout_path,
     )
     if synced is None:
diff --git a/src/generate_repo_overview/constants.py b/src/generate_repo_overview/constants.py
index 3f2b282..3147e5c 100644
--- a/src/generate_repo_overview/constants.py
+++ b/src/generate_repo_overview/constants.py
@@ -1,8 +1,9 @@
 from __future__ import annotations
 
-import os
 from pathlib import Path
 
+from repo_cache import default_cache_directory
+
 DEFAULT_OUTPUT = Path("profile/README.md")
 DEFAULT_METRICS_HTML_OUTPUT = Path("_site")
 DEFAULT_CACHE = Path(".cache/repo_overview.json")
@@ -12,13 +13,4 @@
 DEFAULT_POLICY_REPORT_FILENAME = "repo-policy-sync-report.json"
 DEFAULT_POLICY_REPORT_CACHE = Path(".cache/repo-policy-sync-report.json")
 
-
-def default_repository_checkout_cache() -> Path:
-    """Return the shared SCORE checkout cache without creating it."""
-
-    xdg_cache_home = os.environ.get("XDG_CACHE_HOME")
-    cache_home = Path(xdg_cache_home) if xdg_cache_home else Path.home() / ".cache"
-    return cache_home / "repo-cache"
-
-
-DEFAULT_REPOSITORY_CHECKOUTS = default_repository_checkout_cache()
+DEFAULT_REPOSITORY_CHECKOUTS = default_cache_directory()
diff --git a/src/generate_repo_overview/org_config.py b/src/generate_repo_overview/org_config.py
index 447d594..7f02b11 100644
--- a/src/generate_repo_overview/org_config.py
+++ b/src/generate_repo_overview/org_config.py
@@ -3,7 +3,7 @@
 import fnmatch
 import tomllib
 from dataclasses import dataclass, field
-from pathlib import Path
+from pathlib import Path, PureWindowsPath
 from typing import Any, cast
 
 from generate_repo_overview.constants import (
@@ -137,7 +137,7 @@ def load_org_config(path: Path) -> OrgConfig:
         ("reference_integration_repo", reference_integration_repo),
         ("registry_repo", registry_repo),
     ):
-        if field_value and "/" not in field_value:
+        if field_value and not is_safe_repository_path(field_value):
             raise ValueError(
                 f"{field_name} must be in 'org/repo' format, got '{field_value}'."
             )
@@ -167,6 +167,15 @@ def _str_or(value: object, default: str) -> str:
     return default
 
 
+def is_safe_repository_path(value: str) -> bool:
+    """Return whether *value* is a safe two-component repository path."""
+
+    if "\\" in value or PureWindowsPath(value).anchor:
+        return False
+    parts = value.split("/")
+    return len(parts) == 2 and all(part and part not in {".", ".."} for part in parts)
+
+
 def _parse_string_list(value: object) -> tuple[str, ...]:
     if value is None:
         return ()
@@ -202,7 +211,7 @@ def _parse_tracked_deps(value: object) -> tuple[TrackedDep, ...]:
 def _parse_repo_list(value: object, *, field_name: str) -> tuple[str, ...]:
     repos = _parse_string_list(value)
     for repo in repos:
-        if "/" not in repo:
+        if not is_safe_repository_path(repo):
             raise ValueError(
                 f"{field_name} entries must be in 'org/repo' format, got '{repo}'."
             )
diff --git a/tests/test_git_checkout.py b/tests/test_git_checkout.py
index f217e1f..23c2333 100644
--- a/tests/test_git_checkout.py
+++ b/tests/test_git_checkout.py
@@ -2,7 +2,9 @@
 from pathlib import Path
 
 import pytest
+from repo_cache import RepoCacheError
 
+import generate_repo_overview.collector.git_checkout as git_checkout
 from generate_repo_overview.collector.git_checkout import (
     fetch_repository_ref,
     get_checkout_head_date,
@@ -11,21 +13,58 @@
     read_repository_text,
     read_repository_text_at_ref,
     remote_repository_has_refs,
-    sync_repository_checkout,
 )
-from generate_repo_overview.constants import default_repository_checkout_cache
 
 
-def test_default_checkout_cache_uses_xdg_location(
+def test_github_checkout_uses_shared_repo_cache(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
 ) -> None:
-    monkeypatch.setenv("XDG_CACHE_HOME", str(tmp_path))
+    calls: list[dict[str, object]] = []
 
-    assert default_repository_checkout_cache() == tmp_path / "repo-cache"
+    def fake_sync(**kwargs: object) -> None:
+        calls.append(kwargs)
 
+    monkeypatch.setattr(git_checkout, "sync_default_branch", fake_sync)
+    checkout = tmp_path / "checkout"
+
+    assert (
+        git_checkout.sync_repository_checkout(
+            repository="eclipse-score/tools",
+            default_branch="main",
+            checkout_path=checkout,
+        )
+        == checkout
+    )
+    assert calls == [
+        {
+            "repository": "eclipse-score/tools",
+            "branch": "main",
+            "destination": checkout,
+        }
+    ]
+
+
+def test_github_checkout_failure_keeps_best_effort_contract(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    def fail_sync(**_: object) -> None:
+        raise RepoCacheError("checkout failed")
+
+    monkeypatch.setattr(git_checkout, "sync_default_branch", fail_sync)
+
+    assert (
+        git_checkout.sync_repository_checkout(
+            repository="eclipse-score/tools",
+            default_branch="main",
+            checkout_path=tmp_path / "checkout",
+        )
+        is None
+    )
 
-def test_checkout_syncs_branch_and_reads_release_ref(tmp_path: Path) -> None:
+
+def test_checkout_helpers_read_release_ref(tmp_path: Path) -> None:
     source = tmp_path / "source"
     checkout = tmp_path / "checkout"
     _git(source.parent, "init", "--initial-branch=main", str(source))
@@ -39,14 +78,13 @@ def test_checkout_syncs_branch_and_reads_release_ref(tmp_path: Path) -> None:
     _git(source, "commit", "-m", "initial")
     _git(source, "tag", "v1.0.0")
 
-    synced = sync_repository_checkout(
-        clone_url=str(source),
-        default_branch="main",
-        github_token=None,
-        checkout_path=checkout,
+    subprocess.run(
+        ["git", "clone", str(source), str(checkout)],
+        check=True,
+        capture_output=True,
+        text=True,
     )
 
-    assert synced == checkout
     assert "MODULE.bazel" in list_repository_paths(checkout)
     assert read_repository_text(checkout, "MODULE.bazel") == (
         'module(name = "score_example")\n'
@@ -55,20 +93,6 @@ def test_checkout_syncs_branch_and_reads_release_ref(tmp_path: Path) -> None:
     assert initial_sha
     assert get_checkout_head_date(checkout)
 
-    (source / ".bazelversion").write_text("8.4.2\n", encoding="utf-8")
-    _git(source, "add", ".bazelversion")
-    _git(source, "commit", "-m", "update")
-    assert (
-        sync_repository_checkout(
-            clone_url=str(source),
-            default_branch="main",
-            github_token=None,
-            checkout_path=checkout,
-        )
-        == checkout
-    )
-    assert get_checkout_head_sha(checkout) != initial_sha
-
     release_ref = fetch_repository_ref(
         checkout,
         "v1.0.0",
@@ -87,19 +111,9 @@ def test_checkout_syncs_branch_and_reads_release_ref(tmp_path: Path) -> None:
 
 def test_empty_repository_has_no_remote_refs(tmp_path: Path) -> None:
     source = tmp_path / "source"
-    checkout = tmp_path / "checkout"
     _git(source.parent, "init", "--initial-branch=main", str(source))
 
     assert remote_repository_has_refs(str(source), github_token=None) is False
-    assert (
-        sync_repository_checkout(
-            clone_url=str(source),
-            default_branch="main",
-            github_token=None,
-            checkout_path=checkout,
-        )
-        is None
-    )
 
 
 def _git(cwd: Path, *args: str) -> None:
diff --git a/tests/test_org_config.py b/tests/test_org_config.py
index f118698..2e6ad8b 100644
--- a/tests/test_org_config.py
+++ b/tests/test_org_config.py
@@ -179,6 +179,31 @@ def test_registry_repo_without_slash_errors(self, tmp_path: Path) -> None:
         with pytest.raises(ValueError, match="org/repo"):
             load_org_config(toml_path)
 
+    @pytest.mark.parametrize(
+        ("registry_repo", "expected_message"),
+        [
+            ("../etc", "org/repo"),
+            ("/tmp/registry", "org/repo"),
+            ("C:/registry", "org/repo"),
+            ("org/../registry", "org/repo"),
+            (r"org\..\registry", "org/repo"),
+        ],
+    )
+    def test_registry_repo_path_traversal_errors(
+        self, tmp_path: Path, registry_repo: str, expected_message: str
+    ) -> None:
+        content = dedent(
+            f"""\
+            org_name = "test"
+            [signals]
+            registry_repo = '{registry_repo}'
+            """
+        )
+        toml_path = tmp_path / "org.toml"
+        toml_path.write_text(content, encoding="utf-8")
+        with pytest.raises(ValueError, match=expected_message):
+            load_org_config(toml_path)
+
     def test_platform_repo_without_slash_errors(self, tmp_path: Path) -> None:
         content = dedent("""\
             org_name = "test"
diff --git a/tests/test_repo_overview.py b/tests/test_repo_overview.py
index 47ca203..d382b7e 100644
--- a/tests/test_repo_overview.py
+++ b/tests/test_repo_overview.py
@@ -1,3 +1,4 @@
+import os
 import subprocess
 import sys
 import time
@@ -341,6 +342,54 @@ def get_latest_release(self) -> SimpleNamespace:
     assert entry.content.matched_workflow_signals == ()
 
 
+def test_fetch_repositories_uses_resolved_registry_repository_cache_key(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    observed_registry_repositories: list[str] = []
+    organization = SimpleNamespace(login="eclipse-score")
+    config = OrgConfig(
+        org_name="eclipse-score",
+        reference_integration_repo="eclipse-score/reference-integration",
+        registry_repo="eclipse-score/bazel_registry",
+    )
+    resolved_registry_repository = SimpleNamespace(
+        full_name="Eclipse-Score/Bazel_Registry"
+    )
+
+    monkeypatch.setattr(
+        collector,
+        "fetch_active_repositories",
+        lambda *_args, **_kwargs: {},
+    )
+    monkeypatch.setattr(
+        collector.registry_metadata,
+        "fetch_bazel_registry_metadata_by_repo",
+        lambda **_kwargs: {},
+    )
+
+    def fake_fetch_reference_integration_repository_names(
+        **kwargs: Any,
+    ) -> set[str]:
+        observed_registry_repositories.append(kwargs["registry_repository"])
+        return set()
+
+    monkeypatch.setattr(
+        collector.reference_integration,
+        "fetch_reference_integration_repository_names",
+        fake_fetch_reference_integration_repository_names,
+    )
+
+    assert (
+        collector.fetch_repositories(
+            cast("Any", organization),
+            config=config,
+            registry_repository=resolved_registry_repository,
+        )
+        == []
+    )
+    assert observed_registry_repositories == ["Eclipse-Score/Bazel_Registry"]
+
+
 def test_collect_repository_entry_reuses_cached_details_when_unchanged() -> None:
     class FakeRepo:
         default_branch = "main"
@@ -506,6 +555,7 @@ def get_pulls(self, **_: Any) -> list[object]:
         "DEFAULT_REPOSITORY_CHECKOUTS",
         tmp_path / "checkouts",
     )
+    monkeypatch.setattr(repo_entry, "sync_repository_checkout", lambda **_: None)
 
     entry = repo_entry.collect_repository_entry(
         repository_name="empty",
@@ -568,6 +618,7 @@ def get_pulls(self, **_: Any) -> list[object]:
         "DEFAULT_REPOSITORY_CHECKOUTS",
         tmp_path / "checkouts",
     )
+    monkeypatch.setattr(repo_entry, "sync_repository_checkout", lambda **_: None)
 
     entry = repo_entry.collect_repository_entry(
         repository_name="empty-no-default-branch",
@@ -1037,7 +1088,8 @@ def test_reference_integration_maps_bazel_registry_modules_to_repositories(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    registry_root = tmp_path / "bazel_registry_checkout"
+    registry_repository = "eclipse-score/bazel_registry"
+    registry_root = tmp_path / registry_repository
     metadata_dir = registry_root / "modules" / "score_process"
     metadata_dir.mkdir(parents=True)
     (metadata_dir / "metadata.json").write_text(
@@ -1051,15 +1103,47 @@ def test_reference_integration_maps_bazel_registry_modules_to_repositories(
     )
     monkeypatch.setattr(
         reference_integration,
-        "BAZEL_REGISTRY_LOCAL_CHECKOUT",
-        registry_root,
+        "default_cache_directory",
+        lambda: tmp_path,
     )
 
     assert reference_integration.get_bazel_registry_repositories_by_module(
-        active_repository_names={"process_description"}
+        active_repository_names={"process_description"},
+        registry_repository=registry_repository,
     ) == {"score_process": "process_description"}
 
 
+@pytest.mark.parametrize(
+    ("registry_repository", "expected_repositories"),
+    [
+        ("../outside", {}),
+        ("/tmp/registry", {}),
+        ("C:/registry", {}),
+        ("org/../registry", {}),
+        (r"org\..\registry", {}),
+    ],
+)
+def test_reference_integration_ignores_unsafe_registry_repository_path(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    registry_repository: str,
+    expected_repositories: dict[str, str],
+) -> None:
+    monkeypatch.setattr(
+        reference_integration,
+        "default_cache_directory",
+        lambda: tmp_path / "cache",
+    )
+
+    assert (
+        reference_integration.get_bazel_registry_repositories_by_module(
+            active_repository_names={"process_description"},
+            registry_repository=registry_repository,
+        )
+        == expected_repositories
+    )
+
+
 def test_get_codeowners_for_path_prefers_specific_codeowners_rule() -> None:
     assert signal_detection.get_codeowners_for_path(
         """
@@ -1237,7 +1321,14 @@ def get_organization(self, org_name: str) -> SimpleNamespace:
 
     monkeypatch.setitem(sys.modules, "github", fake_github_module)
     monkeypatch.setattr(collector, "resolve_github_token", lambda token_env: "token")
-    monkeypatch.setattr(collector, "fetch_repositories", lambda *args, **kwargs: [])
+    monkeypatch.setenv("GH_TOKEN", "original-token")
+    observed_gh_tokens: list[str | None] = []
+
+    def fake_fetch_repositories(*args: Any, **kwargs: Any) -> list[RepoEntry]:
+        observed_gh_tokens.append(os.getenv("GH_TOKEN"))
+        return []
+
+    monkeypatch.setattr(collector, "fetch_repositories", fake_fetch_repositories)
 
     snapshot = collector.collect_snapshot(
         config=OrgConfig(org_name="eclipse-score"),
@@ -1248,6 +1339,8 @@ def get_organization(self, org_name: str) -> SimpleNamespace:
 
     assert snapshot.org_name == "eclipse-score"
     assert snapshot.repos == ()
+    assert observed_gh_tokens == ["token"]
+    assert os.getenv("GH_TOKEN") == "original-token"
     assert (
         "GitHub REST API rate limit before collection: remaining 4999/5000, "
         "used 1, resets at 2026-04-14T12:00:00+00:00" in captured.err
diff --git a/uv.lock b/uv.lock
index e29d6d3..5235f10 100644
--- a/uv.lock
+++ b/uv.lock
@@ -248,6 +248,7 @@ version = "0.0.0"
 source = { editable = "." }
 dependencies = [
     { name = "pygithub" },
+    { name = "repo-cache" },
     { name = "tqdm" },
 ]
 
@@ -262,6 +263,7 @@ dev = [
 [package.metadata]
 requires-dist = [
     { name = "pygithub" },
+    { name = "repo-cache", git = "https://github.com/eclipse-score/tools?subdirectory=repo_cache" },
     { name = "tqdm" },
 ]
 
@@ -526,6 +528,11 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f1/12/de94a39c2ef588c7e6455cfbe7343d3b2dc9d6b6b2f40c4c6565744c873d/pyyaml-6.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b", size = 149341, upload-time = "2025-09-25T21:32:56.828Z" },
 ]
 
+[[package]]
+name = "repo-cache"
+version = "0.1.0"
+source = { git = "https://github.com/eclipse-score/tools?subdirectory=repo_cache#35ef100321dbf3983219ad9c242ddaff89d2f777" }
+
 [[package]]
 name = "requests"
 version = "2.33.0"