diff --git a/crates/arc-workflows/src/github_app.rs b/crates/arc-workflows/src/github_app.rs
index 7f4dc86be..27e32feac 100644
--- a/crates/arc-workflows/src/github_app.rs
+++ b/crates/arc-workflows/src/github_app.rs
@@ -60,8 +60,9 @@ pub fn sign_app_jwt(app_id: &str, private_key_pem: &str) -> Result<String, Strin
     let key = EncodingKey::from_rsa_pem(private_key_pem.as_bytes())
         .map_err(|e| format!("Invalid RSA private key: {e}"))?;
 
-    encode(&Header::new(Algorithm::RS256), &claims, &key)
-        .map_err(|e| format!("Failed to sign JWT: {e}"))
+    let jwt = encode(&Header::new(Algorithm::RS256), &claims, &key)
+        .map_err(|e| format!("Failed to sign JWT: {e}"))?;
+    Ok(jwt)
 }
 
 /// Check whether a GitHub repository is public using the App JWT.
@@ -88,7 +89,13 @@ pub async fn is_repo_public(
         .map_err(|e| format!("Failed to check repo visibility: {e}"))?;
 
     let status = response.status();
-    if status == reqwest::StatusCode::NOT_FOUND {
+    // 404 = repo not found (or not visible); 401/403 = app JWT can't read repos.
+    // In all these cases, assume the repo is private and proceed to get an
+    // installation access token, which WILL have the right permissions.
+    if status == reqwest::StatusCode::NOT_FOUND
+        || status == reqwest::StatusCode::UNAUTHORIZED
+        || status == reqwest::StatusCode::FORBIDDEN
+    {
         return Ok(false);
     }
     if !status.is_success() {
diff --git a/test/docs/run_tests.sh b/test/docs/run_tests.sh
index 04c030ea3..e3d18bf24 100755
--- a/test/docs/run_tests.sh
+++ b/test/docs/run_tests.sh
@@ -38,6 +38,19 @@ run_one() {
                 fail=$((fail + 1))
             fi
             ;;
+        preflight)
+            # cd into the dot file's directory so relative paths resolve
+            local target="$dot_name"
+            [[ -f "$toml" ]] && target="run-${stem}.toml"
+
+            if (cd "$dot_dir" && "$ARC" run start "$target" --preflight 2>&1); then
+                echo "  PASS  $rel"
+                pass=$((pass + 1))
+            else
+                echo "  FAIL  $rel"
+                fail=$((fail + 1))
+            fi
+            ;;
         dry-run|haiku|full)
             # cd into the dot file's directory so relative script paths resolve
             local target="$dot_name"
@@ -56,7 +69,7 @@ run_one() {
             fi
             ;;
         *)
-            echo "Usage: $0 <validate|dry-run|haiku|full>"
+            echo "Usage: $0 <validate|preflight|dry-run|haiku|full>"
             exit 1
             ;;
     esac