diff --git a/apps/arc-web/app/lib/github.server.ts b/apps/arc-web/app/lib/github.server.ts
index 5e70dde95..7ef6f832a 100644
--- a/apps/arc-web/app/lib/github.server.ts
+++ b/apps/arc-web/app/lib/github.server.ts
@@ -14,3 +14,14 @@ export function getGitHubOAuth() {
 export function isGitHubAppConfigured(): boolean {
   return !!process.env.GITHUB_APP_CLIENT_ID;
 }
+
+export function getGitHubAppPrivateKey(): string {
+  const raw = process.env.GITHUB_APP_PRIVATE_KEY;
+  if (!raw) {
+    throw new Error("GITHUB_APP_PRIVATE_KEY is not configured");
+  }
+  if (raw.startsWith("-----BEGIN")) {
+    return raw;
+  }
+  return Buffer.from(raw, "base64").toString("utf-8");
+}
diff --git a/apps/arc-web/app/routes/setup-callback.tsx b/apps/arc-web/app/routes/setup-callback.tsx
index 82081e036..56a8e2651 100644
--- a/apps/arc-web/app/routes/setup-callback.tsx
+++ b/apps/arc-web/app/routes/setup-callback.tsx
@@ -46,7 +46,7 @@ export async function loader({ request }: Route.LoaderArgs) {
     `export GITHUB_APP_CLIENT_ID=${data.client_id}`,
     `export GITHUB_APP_CLIENT_SECRET=${data.client_secret}`,
     `export GITHUB_APP_WEBHOOK_SECRET=${data.webhook_secret}`,
-    `export GITHUB_APP_PRIVATE_KEY="${data.pem}"`,
+    `export GITHUB_APP_PRIVATE_KEY=${Buffer.from(data.pem).toString("base64")}`,
   ].join("\n");
 
   const envContent = existing ? `${existing.trimEnd()}\n\n${newVars}\n` : `${newVars}\n`;
@@ -57,7 +57,7 @@ export async function loader({ request }: Route.LoaderArgs) {
   process.env.GITHUB_APP_CLIENT_ID = data.client_id;
   process.env.GITHUB_APP_CLIENT_SECRET = data.client_secret;
   process.env.GITHUB_APP_WEBHOOK_SECRET = data.webhook_secret;
-  process.env.GITHUB_APP_PRIVATE_KEY = data.pem;
+  process.env.GITHUB_APP_PRIVATE_KEY = Buffer.from(data.pem).toString("base64");
 
   throw redirect("/auth/login");
 }