diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -42,10 +42,9 @@
     "debug": "^2.6.3",
     "dugite": "^1.57.0",
     "fs-extra": "^2.1.2",
-    "git-credential-envvar": "^1.1.0",
+    "git-askpass-env": "^0.0.3",
     "ini": "^1.3.4",
     "iso8601": "^1.1.1",
-    "lodash": "^4.17.4",
     "lodash.clone": "^4.5.0",
     "lodash.flatten": "^4.4.0",
     "lodash.isnumber": "^3.0.3",
@@ -54,7 +53,6 @@
     "mime-types": "^2.1.15",
     "mkdirp": "^0.5.1",
     "mz": "^2.7.0",
-    "nodegit": "^0.18.3",
     "parse-link-header": "^0.4.1",
     "pify": "^2.3.0",
     "request-promise": "^4.2.0",
@@ -89,7 +87,6 @@
     "@types/rimraf": "^2.0.0",
     "@types/temp": "^0.8.29",
     "babel-cli": "^6.24.1",
-    "babel-eslint": "^7",
     "babel-plugin-__coverage__": "^11.0.0",
     "babel-preset-es2016-node5": "^1",
     "babel-register": "^6.24.1",

diff --git a/src/git-api.ts b/src/git-api.ts
@@ -8,6 +8,7 @@ import { getNwoFromRepoUrl } from './github-api';
 import { toIso8601 } from 'iso8601';
 import { statNoException, statSyncNoException } from './promise-array';
 import { rimraf, mkdirp, mkdirpSync } from './recursive-fs';
+import { findActualExecutable } from 'spawn-rx';
 
 import * as fs from 'mz/fs';
 
@@ -16,9 +17,12 @@ const d = require('debug')('surf:git-api');
 
 export async function git(args: string[], cwd: string, token?: string): Promise<string> {
   token = token || process.env.GITHUB_TOKEN;
-  process.env.GIT_ASKPASS = 'envvar';
-  process.env.GITCREDENTIALUSERNAME = 'token';
-  process.env.GITCREDENTIALPASSWORD = token;
+  const { cmd } = findActualExecutable('git-askpass-env', []);
+
+  d(`Actually using token! ${token}`);
+  process.env.GIT_ASKPASS = cmd;
+  process.env.GIT_ASKPASS_USER = token;
+  process.env.GIT_ASKPASS_PASSWORD = 'x-oauth-basic';
 
   let ret = await GitProcess.exec(args, cwd);
   if (ret.exitCode !== 0) {