diff --git a/docs/src/content/docs/reference/auth.mdx b/docs/src/content/docs/reference/auth.mdx
index 008d4e8bba8..59f7bd84e89 100644
--- a/docs/src/content/docs/reference/auth.mdx
+++ b/docs/src/content/docs/reference/auth.mdx
@@ -100,6 +100,36 @@ If your workflow fails at the Copilot inference step even with the token set, ve
 
 ---
 
+### `GH_AW_GITHUB_TOKEN`
+
+`GH_AW_GITHUB_TOKEN` is an optional "magic" GitHub Actions secret used as the default fallback token for GitHub operations outside engine inference.
+
+Use it when your workflow needs authenticated GitHub access beyond the default `GITHUB_TOKEN`, for example:
+
+- Safe outputs that write to other repositories
+- Safe outputs that trigger CI on pull requests
+- Safe outputs or tools that need broader repo/API access than the default token provides
+- Fallback when `github-app.ignore-if-missing: true` is used and app secrets are unavailable
+
+Fallback chain:
+
+`custom github-token` → `secrets.GH_AW_GITHUB_TOKEN` → `secrets.GITHUB_TOKEN`
+
+**How to create it**:
+
+1. Create a [fine-grained PAT](https://github.com/settings/personal-access-tokens/new) owned by a user account.
+2. Scope repository access to the minimum set of repositories needed.
+3. Grant only the minimum required permissions for your configured operations (for example, `Issues: write` for issue outputs, `Pull requests: write` for PR outputs, `Contents: write` for commit/branch writes, `Actions: write` for workflow dispatch/rerun operations).
+4. Store it as a repository secret:
+
+   ```bash wrap
+   gh aw secrets set GH_AW_GITHUB_TOKEN --value "<your-github-pat>"
+   ```
+
+`GH_AW_GITHUB_TOKEN` does **not** replace `COPILOT_GITHUB_TOKEN` for Copilot inference authentication.
+
+---
+
 ### `ANTHROPIC_API_KEY`
 
 If using the Claude by Anthropic engine, you need to set a GitHub Actions secret `ANTHROPIC_API_KEY` to be an API key from Anthropic.
diff --git a/docs/src/content/docs/reference/faq.md b/docs/src/content/docs/reference/faq.md
index 7dac4ea09fc..26060fb9bd0 100644
--- a/docs/src/content/docs/reference/faq.md
+++ b/docs/src/content/docs/reference/faq.md
@@ -165,6 +165,37 @@ if: github.event_name == 'push' && github.ref == 'refs/heads/main'
 
 See [Conditional Execution](/gh-aw/reference/frontmatter/#conditional-execution-if) in the Frontmatter Reference for details.
 
+### How should I configure Go caches safely in agentic workflows?
+
+For Go workflows, cache module downloads and build artifacts explicitly, and scope cache keys tightly:
+
+```yaml wrap
+cache:
+  key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
+  path: |
+    ~/go/pkg/mod
+    ~/.cache/go-build
+  restore-keys: |
+    go-${{ runner.os }}-
+
+jobs:
+  setup:
+    steps:
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache: false
+      - run: |
+          echo "GOMODCACHE=$HOME/go/pkg/mod" >> "$GITHUB_ENV"
+          echo "GOCACHE=$HOME/.cache/go-build" >> "$GITHUB_ENV"
+```
+
+Security guidance:
+
+- Keep keys specific to OS and dependency lock state (`go.sum`) to reduce accidental cross-context restores.
+- Do not share writeable cache keys across trust boundaries (for example, untrusted fork PR runs and protected branch runs).
+- Never place secrets in `GOMODCACHE`/`GOCACHE`; these directories should contain only modules and build outputs.
+
 ## Guardrails
 
 ### Agentic workflows run in GitHub Actions. Can they access my repository secrets?
diff --git a/docs/src/content/docs/reference/frontmatter.md b/docs/src/content/docs/reference/frontmatter.md
index 8a74100cbc0..9c41bed6699 100644
--- a/docs/src/content/docs/reference/frontmatter.md
+++ b/docs/src/content/docs/reference/frontmatter.md
@@ -124,6 +124,8 @@ cache:
     node-modules-
 ```
 
+For secure Go-specific cache guidance, see [FAQ: How should I configure Go caches safely in agentic workflows?](/gh-aw/reference/faq/#how-should-i-configure-go-caches-safely-in-agentic-workflows).
+
 ### Repository Checkout (`checkout:`)
 
 Configure how `actions/checkout` is invoked in the agent job. Override default checkout settings or check out multiple repositories for cross-repository workflows.
diff --git a/docs/src/content/docs/reference/glossary.md b/docs/src/content/docs/reference/glossary.md
index 8ac4e43475d..14f293d0f57 100644
--- a/docs/src/content/docs/reference/glossary.md
+++ b/docs/src/content/docs/reference/glossary.md
@@ -240,6 +240,10 @@ A safe output capability (`assign-to-agent:`) that programmatically assigns the
 
 A recognized "magic" repository secret name that GitHub Agentic Workflows automatically uses as a fallback Personal Access Token for `assign-to-agent` operations. When set, no explicit `github-token:` reference is needed in workflow frontmatter — the token is injected automatically. Required because GitHub App installation tokens are rejected by the Copilot assignment API. The token fallback chain is: `assign-to-agent.github-token` → `safe-outputs.github-token` → `GH_AW_AGENT_TOKEN` → `GH_AW_GITHUB_TOKEN` → `GITHUB_TOKEN`. See [Copilot Cloud Agent](/gh-aw/reference/copilot-cloud-agent/).
 
+### GH_AW_GITHUB_TOKEN
+
+A recognized "magic" repository secret name used as the default fallback token for GitHub operations outside engine inference when no explicit `github-token:` is configured. Commonly used for safe outputs and tool operations that require permissions beyond the default `GITHUB_TOKEN`, and as the non-App fallback when `github-app.ignore-if-missing: true` is enabled. Fallback chain: `custom github-token` → `GH_AW_GITHUB_TOKEN` → `GITHUB_TOKEN`. See [Authentication Reference](/gh-aw/reference/auth/).
+
 ### Custom Safe Outputs
 
 An extension mechanism for safe outputs that enables integration with third-party services beyond built-in GitHub operations. Defined under `safe-outputs.jobs:`, custom safe outputs separate read and write operations: agents use read-only MCP tools for queries, while custom jobs execute write operations with secret access after agent completion. Supports services like Slack, Notion, Jira, or any external API. See [Custom Safe Outputs](/gh-aw/reference/custom-safe-outputs/).
diff --git a/docs/src/content/docs/reference/sandbox.md b/docs/src/content/docs/reference/sandbox.md
index 582105a6364..66f0c5b4c95 100644
--- a/docs/src/content/docs/reference/sandbox.md
+++ b/docs/src/content/docs/reference/sandbox.md
@@ -127,6 +127,25 @@ jobs:
 Use `go build` or `python3` - both are available.
 ```
 
+#### Go cache paths in AWF (`GOMODCACHE` / `GOCACHE`)
+
+When using `actions/setup-go` in AWF, pin Go cache paths explicitly so restore behavior is predictable:
+
+```yaml wrap
+jobs:
+  setup:
+    steps:
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache: false
+      - run: |
+          echo "GOMODCACHE=$HOME/go/pkg/mod" >> "$GITHUB_ENV"
+          echo "GOCACHE=$HOME/.cache/go-build" >> "$GITHUB_ENV"
+```
+
+Then cache those paths via top-level `cache:` (see [Frontmatter cache configuration](/gh-aw/reference/frontmatter/)). Keep cache keys scoped to trusted contexts and avoid sharing writeable keys between untrusted and protected runs.
+
 ## MCP Gateway
 
 The MCP Gateway routes all MCP server calls through a unified HTTP gateway, enabling centralized management, logging, and authentication for MCP tools.
