diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c43fae55..b0c88dfa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -164,6 +164,14 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
 
+      # Same rewrite as the setup job. Dependabot-regenerated lockfiles
+      # resolve @electron/node-gyp as git@github.com: (SSH). Runners have
+      # no deploy key, so install dies in ~20s with "Permission denied
+      # (publickey)" — that is why Dependabot PRs fail e2e while develop
+      # (HTTPS tarball in the lockfile) stays green. See #544.
+      - name: Force HTTPS for GitHub git dependencies
+        run: git config --global 'url.https://github.com/.insteadOf' 'git@github.com:'
+
       - name: Install dependencies (with postinstall scripts)
         run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 4a7fa4bf..bde45aa4 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -39,6 +39,11 @@ jobs:
           node-version: '22'
           cache: 'pnpm'
 
+      # Dependabot lockfiles resolve @electron/node-gyp as git@github.com:.
+      # Without this rewrite, `pnpm install` dies on SSH (see #544 / e2e).
+      - name: Force HTTPS for GitHub git dependencies
+        run: git config --global 'url.https://github.com/.insteadOf' 'git@github.com:'
+
       # Title check only needs commitlint + its config — no workspace
       # native deps, no postinstall.
       - name: Install commitlint