diff --git a/env.sh b/env.sh
index a01de375..2acdf818 100755
--- a/env.sh
+++ b/env.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-
+set -eo pipefail
 set -e
 
 echo "Obtaining release vector variables..."
@@ -8,8 +8,21 @@ yq_shell() {
   docker run --rm -i -v ${PWD}:/workdir mikefarah/yq:3 /bin/sh -c "$@"
 }
 
+download_oci_release_vector() {
+  local image="$1"
+  local tag="$2"
+
+  local token=$(curl -s "https://ghcr.io/token?scope=repository:$image:pull&service=ghcr.io" | jq -r .token)
+
+  local manifest=$(curl -s -L -H "Accept: application/vnd.oci.image.manifest.v1+json" -H "Authorization: Bearer $token" https://ghcr.io/v2/$image/manifests/$tag)
+  local digest=$(echo "$manifest" | jq -r '.layers[] | select(.mediaType == "application/vnd.metal-stack.release-vector.v1.tar+gzip") | .digest')
+
+  RELEASE_YAML="$(curl -s -L -H "Authorization: Bearer $token" "https://ghcr.io/v2/$image/blobs/$digest" | tar xzO release.yaml)"
+}
+
 METAL_STACK_RELEASE_VERSION=$(yq_shell "yq r inventories/group_vars/all/release_vector.yaml 'metal_stack_release_version'")
-RELEASE_YAML=$(curl -s https://raw.githubusercontent.com/metal-stack/releases/${METAL_STACK_RELEASE_VERSION}/release.yaml)
+download_oci_release_vector metal-stack/releases $METAL_STACK_RELEASE_VERSION
+
 METALCTL_IMAGE_TAG=$(yq_shell "echo \"${RELEASE_YAML}\" | yq r - docker-images.metal-stack.control-plane.metalctl.tag")
 DEPLOYMENT_BASE_IMAGE_TAG=$(yq_shell "echo \"${RELEASE_YAML}\" | yq r - docker-images.metal-stack.generic.deployment-base.tag")