diff --git a/.github/workflows/ios-xcode-cloud.yml b/.github/workflows/ios-xcode-cloud.yml
index 7ad0a92a..7da977f2 100644
--- a/.github/workflows/ios-xcode-cloud.yml
+++ b/.github/workflows/ios-xcode-cloud.yml
@@ -78,13 +78,23 @@ jobs:
           store_version = os.environ.get("APP_STORE_VERSION", "").strip()
           store_build_id = os.environ.get("APP_STORE_BUILD_ID", "").strip()
 
-          now = int(time.time())
-          token = jwt.encode(
-              {"iss": issuer, "iat": now, "exp": now + 20 * 60, "aud": "appstoreconnect-v1"},
-              private_key,
-              algorithm="ES256",
-              headers={"kid": key_id, "typ": "JWT"},
-          )
+          token = None
+          token_exp = 0
+
+          def ensure_token():
+              global token, token_exp
+              now = int(time.time())
+              if token and now < token_exp - 60:
+                  return token
+              token_exp = now + 20 * 60
+              encoded = jwt.encode(
+                  {"iss": issuer, "iat": now, "exp": token_exp, "aud": "appstoreconnect-v1"},
+                  private_key,
+                  algorithm="ES256",
+                  headers={"kid": key_id, "typ": "JWT"},
+              )
+              token = encoded.decode() if isinstance(encoded, bytes) else encoded
+              return token
 
           def api(method, path, body=None):
               request = urllib.request.Request(
@@ -92,7 +102,7 @@ jobs:
                   data=None if body is None else json.dumps(body).encode(),
                   method=method,
               )
-              request.add_header("Authorization", f"Bearer {token}")
+              request.add_header("Authorization", f"Bearer {ensure_token()}")
               if body is not None:
                   request.add_header("Content-Type", "application/json")
               try: