diff --git a/playbooks/1password.yaml b/playbooks/1password.yaml
index dfbdd52..0cadffc 100644
--- a/playbooks/1password.yaml
+++ b/playbooks/1password.yaml
@@ -1,4 +1,6 @@
 ---
 - hosts: localhost
+  vars_files:
+    - vars/environment.yaml
   roles:
     - 1password
diff --git a/playbooks/Linux.yaml b/playbooks/Linux.yaml
index c1ca009..695cf24 100644
--- a/playbooks/Linux.yaml
+++ b/playbooks/Linux.yaml
@@ -2,10 +2,8 @@
 - import_playbook: LinuxCLI.yaml
 - import_playbook: UnixGUI.yaml
 - hosts: localhost
-  vars:
-    github_auth_headers: >-
-      {{ { 'Authorization': 'Bearer ' + lookup('env', 'GITHUB_TOKEN') }
-          if lookup('env', 'GITHUB_TOKEN') else {} }}
+  vars_files:
+    - vars/environment.yaml
   roles:
     - role: firefox
     - role: kitty
diff --git a/playbooks/LinuxCLI.yaml b/playbooks/LinuxCLI.yaml
index 046e413..8bdb01d 100644
--- a/playbooks/LinuxCLI.yaml
+++ b/playbooks/LinuxCLI.yaml
@@ -1,14 +1,14 @@
 ---
 - hosts: localhost
-  vars:
-    github_auth_headers: >-
-      {{ { 'Authorization': 'Bearer ' + lookup('env', 'GITHUB_TOKEN') }
-          if lookup('env', 'GITHUB_TOKEN') else {} }}
+  vars_files:
+    - vars/environment.yaml
   roles:
     - role: rpmfusion
       when: ansible_os_family == 'RedHat' and ansible_distribution == 'Fedora'
 - import_playbook: UnixCLI.yaml
 - hosts: localhost
+  vars_files:
+    - vars/environment.yaml
   roles:
     - role: gdb
     - role: podman
diff --git a/playbooks/UnixCLI.yaml b/playbooks/UnixCLI.yaml
index 670d7e4..86e5044 100644
--- a/playbooks/UnixCLI.yaml
+++ b/playbooks/UnixCLI.yaml
@@ -1,9 +1,7 @@
 ---
 - hosts: localhost
-  vars:
-    github_auth_headers: >-
-      {{ { 'Authorization': 'Bearer ' + lookup('env', 'GITHUB_TOKEN') }
-          if lookup('env', 'GITHUB_TOKEN') else {} }}
+  vars_files:
+    - vars/environment.yaml
   roles:
     - role: sudo
       when: ansible_user_id != "root"
diff --git a/playbooks/UnixGUI.yaml b/playbooks/UnixGUI.yaml
index 6b950f7..d5a912b 100644
--- a/playbooks/UnixGUI.yaml
+++ b/playbooks/UnixGUI.yaml
@@ -1,9 +1,7 @@
 ---
 - hosts: localhost
-  vars:
-    github_auth_headers: >-
-      {{ { 'Authorization': 'Bearer ' + lookup('env', 'GITHUB_TOKEN') }
-          if lookup('env', 'GITHUB_TOKEN') else {} }}
+  vars_files:
+    - vars/environment.yaml
   roles:
     - role: flatpak
       when: ansible_os_family != "Darwin"
diff --git a/playbooks/WSL.yaml b/playbooks/WSL.yaml
index fac07de..5ddaae5 100644
--- a/playbooks/WSL.yaml
+++ b/playbooks/WSL.yaml
@@ -1,9 +1,7 @@
 ---
 - import_playbook: LinuxCLI.yaml
 - hosts: localhost
-  vars:
-    github_auth_headers: >-
-      {{ { 'Authorization': 'Bearer ' + lookup('env', 'GITHUB_TOKEN') }
-          if lookup('env', 'GITHUB_TOKEN') else {} }}
+  vars_files:
+    - vars/environment.yaml
   roles:
     - role: wsl
diff --git a/playbooks/Windows.yaml b/playbooks/Windows.yaml
index 57dbb0c..d59c96c 100644
--- a/playbooks/Windows.yaml
+++ b/playbooks/Windows.yaml
@@ -1,9 +1,7 @@
 ---
 - hosts: windows
-  vars:
-    github_auth_headers: >-
-      {{ { 'Authorization': 'Bearer ' + lookup('env', 'GITHUB_TOKEN') }
-          if lookup('env', 'GITHUB_TOKEN') else {} }}
+  vars_files:
+    - vars/environment.yaml
   roles:
     - role: python
     - role: git
diff --git a/playbooks/macOS.yaml b/playbooks/macOS.yaml
index df39cc3..435face 100644
--- a/playbooks/macOS.yaml
+++ b/playbooks/macOS.yaml
@@ -1,14 +1,14 @@
 ---
 - import_playbook: UnixCLI.yaml
 - hosts: localhost
+  vars_files:
+    - vars/environment.yaml
   roles:
     - role: system-info
 - import_playbook: UnixGUI.yaml
 - hosts: localhost
-  vars:
-    github_auth_headers: >-
-      {{ { 'Authorization': 'Bearer ' + lookup('env', 'GITHUB_TOKEN') }
-          if lookup('env', 'GITHUB_TOKEN') else {} }}
+  vars_files:
+    - vars/environment.yaml
   roles:
     - role: mas
 
diff --git a/playbooks/vars/environment.yaml b/playbooks/vars/environment.yaml
new file mode 100644
index 0000000..ad05d7e
--- /dev/null
+++ b/playbooks/vars/environment.yaml
@@ -0,0 +1,15 @@
+---
+# GitHub may rate limit unauthenticated API requests, this is more likely when
+# behind a network proxy. Set the GITHUB_TOKEN environment variable to
+# authenticate any GitHub API requests executed while playing roles.
+github_auth_headers: >-
+  {{ { 'Authorization': 'Bearer ' + lookup('env', 'GITHUB_TOKEN') }
+      if lookup('env', 'GITHUB_TOKEN') else {} }}
+
+# When working behind a network proxy, set the http_proxy and https_proxy
+# environment variables. These will be passed through to uses of the `get_url`
+# module when playing roles.
+proxy_environment: >-
+  {{ { 'http_proxy': lookup('env', 'http_proxy'),
+       'https_proxy': lookup('env', 'https_proxy') }
+      if lookup('env', 'http_proxy') and lookup('env', 'https_proxy') else {} }}
diff --git a/roles/1password/tasks/Debian.yaml b/roles/1password/tasks/Debian.yaml
index 2240a78..828743b 100644
--- a/roles/1password/tasks/Debian.yaml
+++ b/roles/1password/tasks/Debian.yaml
@@ -16,6 +16,7 @@
   get_url:
     url: https://downloads.1password.com/linux/keys/1password.asc
     dest: '{{keyring}}'
+  environment: '{{proxy_environment}}'
 
 - name: set compatible architecture
   when: ansible_machine == 'x86_64'
diff --git a/roles/1password/tasks/Windows.yaml b/roles/1password/tasks/Windows.yaml
index 6c4b4a2..9332b02 100644
--- a/roles/1password/tasks/Windows.yaml
+++ b/roles/1password/tasks/Windows.yaml
@@ -16,6 +16,7 @@
   win_get_url:
     url: https://downloads.1password.com/win/1PasswordSetup-latest.exe
     dest: '{{installer_exe}}'
+  environment: '{{proxy_environment}}'
 
 - name: run installer
   when: not app_stat.stat.exists
@@ -68,6 +69,7 @@
   win_get_url:
     url: '{{latest.downloads.Windows.amd64}}'
     dest: '{{cli_zip}}'
+  environment: '{{proxy_environment}}'
 
 - name: unzip op zip archive
   when: cli_installed_version is not defined or cli_installed_version != latest.version
diff --git a/roles/bat/tasks/deb.yaml b/roles/bat/tasks/deb.yaml
index 206d556..f863e1e 100644
--- a/roles/bat/tasks/deb.yaml
+++ b/roles/bat/tasks/deb.yaml
@@ -51,6 +51,7 @@
   get_url:
     url: '{{asset.browser_download_url}}'
     dest: '{{bat_deb}}'
+  environment: '{{proxy_environment}}'
 
 - name: install .deb file
   when: installed_version is not defined or installed_version != latest_version
diff --git a/roles/firefox/tasks/Ubuntu.yaml b/roles/firefox/tasks/Ubuntu.yaml
index e5af090..3fa09cf 100644
--- a/roles/firefox/tasks/Ubuntu.yaml
+++ b/roles/firefox/tasks/Ubuntu.yaml
@@ -17,6 +17,7 @@
   get_url:
     url: https://packages.mozilla.org/apt/repo-signing-key.gpg
     dest: /etc/apt/keyrings/packages.mozilla.org.asc
+  environment: '{{proxy_environment}}'
 
 - name: add mozilla apt repo
   become: true
diff --git a/roles/fonts/tasks/Linux.yaml b/roles/fonts/tasks/Linux.yaml
index 86652bb..fbfa215 100644
--- a/roles/fonts/tasks/Linux.yaml
+++ b/roles/fonts/tasks/Linux.yaml
@@ -37,6 +37,7 @@
   get_url:
     url: '{{asset.browser_download_url}}'
     dest: '{{ansible_env.HOME}}/.local/share/fonts/tmp.zip'
+  environment: '{{proxy_environment}}'
 
 - name: install Caskaydia Cove Nerd Font
   when: needs_installed
diff --git a/roles/gh/tasks/Debian.yaml b/roles/gh/tasks/Debian.yaml
index 0bb7dea..25740a8 100644
--- a/roles/gh/tasks/Debian.yaml
+++ b/roles/gh/tasks/Debian.yaml
@@ -15,6 +15,7 @@
     url: https://cli.github.com/packages/githubcli-archive-keyring.gpg
     dest: /usr/share/keyrings/githubcli-archive-keyring.gpg
     mode: 0644
+  environment: '{{proxy_environment}}'
 
 - name: add apt repository list
   become: true
diff --git a/roles/gh/tasks/RedHat.yaml b/roles/gh/tasks/RedHat.yaml
index 1bbfd73..a8a7f95 100644
--- a/roles/gh/tasks/RedHat.yaml
+++ b/roles/gh/tasks/RedHat.yaml
@@ -4,6 +4,7 @@
   get_url:
     url: https://cli.github.com/packages/rpm/gh-cli.repo
     dest: /etc/yum.repos.d/gh-cli.repo
+  environment: '{{proxy_environment}}'
 
 - name: install dnf package
   become: true
diff --git a/roles/git/tasks/Windows-installer.yaml b/roles/git/tasks/Windows-installer.yaml
index 6a27700..2758158 100644
--- a/roles/git/tasks/Windows-installer.yaml
+++ b/roles/git/tasks/Windows-installer.yaml
@@ -19,6 +19,7 @@
   win_get_url:
     url: '{{git_asset.browser_download_url}}'
     dest: '{{git_installer_path}}'
+  environment: '{{proxy_environment}}'
 
 - name: run installer command
   win_command:
diff --git a/roles/gitea/tasks/Linux.yaml b/roles/gitea/tasks/Linux.yaml
index c272511..ad3f72b 100644
--- a/roles/gitea/tasks/Linux.yaml
+++ b/roles/gitea/tasks/Linux.yaml
@@ -40,6 +40,7 @@
     url: '{{asset.browser_download_url}}'
     dest: '{{tea_package_exe}}'
     mode: '0755'
+  environment: '{{proxy_environment}}'
 
 - name: install package
   when: install_required
diff --git a/roles/glab/tasks/Debian.yaml b/roles/glab/tasks/Debian.yaml
index ca7c763..cf8d7fd 100644
--- a/roles/glab/tasks/Debian.yaml
+++ b/roles/glab/tasks/Debian.yaml
@@ -48,6 +48,7 @@
   get_url:
     url: '{{asset.url}}'
     dest: '{{tempdir.path}}/glab.deb'
+  environment: '{{proxy_environment}}'
 
 - name: install .deb file
   when: glab_version is not defined or glab_version != latest_version
diff --git a/roles/jp/tasks/Darwin.yaml b/roles/jp/tasks/Darwin.yaml
index 1d3dabc..c413aac 100644
--- a/roles/jp/tasks/Darwin.yaml
+++ b/roles/jp/tasks/Darwin.yaml
@@ -40,3 +40,4 @@
     url: '{{asset.browser_download_url}}'
     dest: '{{jp_exe}}'
     mode: +x
+  environment: '{{proxy_environment}}'
diff --git a/roles/jp/tasks/RedHat.yaml b/roles/jp/tasks/RedHat.yaml
index add3f2a..dd9c4a1 100644
--- a/roles/jp/tasks/RedHat.yaml
+++ b/roles/jp/tasks/RedHat.yaml
@@ -50,3 +50,4 @@
     url: '{{asset.browser_download_url}}'
     dest: '{{ansible_env.HOME}}/.local/bin/jp'
     mode: '0755'
+  environment: '{{proxy_environment}}'
diff --git a/roles/llvm/tasks/Ubuntu.yaml b/roles/llvm/tasks/Ubuntu.yaml
index 9a3bb87..ee8b32b 100644
--- a/roles/llvm/tasks/Ubuntu.yaml
+++ b/roles/llvm/tasks/Ubuntu.yaml
@@ -57,6 +57,7 @@
   get_url:
     url: https://apt.llvm.org/llvm-snapshot.gpg.key
     dest: '{{keyring}}'
+  environment: '{{proxy_environment}}'
 
 - name: add upstream deb repository
   become: true
diff --git a/roles/neovim/tasks/Debian.yaml b/roles/neovim/tasks/Debian.yaml
index 745070b..154f71b 100644
--- a/roles/neovim/tasks/Debian.yaml
+++ b/roles/neovim/tasks/Debian.yaml
@@ -79,6 +79,7 @@
   get_url:
     url: '{{asset[0].browser_download_url}}'
     dest: '{{package_path}}'
+  environment: '{{proxy_environment}}'
 
 - name: extract package archive
   when: install_required
diff --git a/roles/nodejs/tasks/Debian.yaml b/roles/nodejs/tasks/Debian.yaml
index 24bb652..65b34f7 100644
--- a/roles/nodejs/tasks/Debian.yaml
+++ b/roles/nodejs/tasks/Debian.yaml
@@ -13,6 +13,7 @@
   get_url:
     url: 'https://nodejs.org/dist/{{latest.json[0].version}}/node-{{latest.json[0].version}}-linux-x64.tar.gz'
     dest: ~/.local/src/node/node.tar.gz
+  environment: '{{proxy_environment}}'
 
 - name: extract downloaded package
   unarchive:
diff --git a/roles/tmux/tasks/Darwin.yaml b/roles/tmux/tasks/Darwin.yaml
index ba57ef2..64e254d 100644
--- a/roles/tmux/tasks/Darwin.yaml
+++ b/roles/tmux/tasks/Darwin.yaml
@@ -18,6 +18,7 @@
   get_url:
     url: https://gist.githubusercontent.com/nicm/ea9cf3c93f22e0246ec858122d9abea1/raw/37ae29fc86e88b48dbc8a674478ad3e7a009f357/tmux-256color
     dest: ~/tmux-256color
+  environment: '{{proxy_environment}}'
 
 - name: compile terminal info
   when: terminfo_exists.rc == 1
diff --git a/roles/ulauncher/tasks/Debian.yaml b/roles/ulauncher/tasks/Debian.yaml
index 9c79cc3..32448d7 100644
--- a/roles/ulauncher/tasks/Debian.yaml
+++ b/roles/ulauncher/tasks/Debian.yaml
@@ -7,6 +7,7 @@
     dest: '{{ulauncher_keyring_path}}'
     mode: '0644'
     force: true
+  environment: '{{proxy_environment}}'
 
 - name: add apt sources list
   when: ansible_distribution == 'Debian'
diff --git a/roles/webcatalog/tasks/Linux.yaml b/roles/webcatalog/tasks/Linux.yaml
index 0ecb524..ed14f0e 100644
--- a/roles/webcatalog/tasks/Linux.yaml
+++ b/roles/webcatalog/tasks/Linux.yaml
@@ -28,6 +28,7 @@
     url: 'https://cdn-2.webcatalog.io/webcatalog/{{appimage}}'
     dest: '{{ansible_env.HOME}}/.local/bin/{{appimage}}'
     mode: '0755'
+  environment: '{{proxy_environment}}'
 
 - name: create directories
   file:
diff --git a/roles/xremap/tasks/main.yaml b/roles/xremap/tasks/main.yaml
index 80bf563..857a616 100644
--- a/roles/xremap/tasks/main.yaml
+++ b/roles/xremap/tasks/main.yaml
@@ -63,6 +63,7 @@
   get_url:
     url: '{{asset.browser_download_url}}'
     dest: '{{install_dir}}/xremap.zip'
+  environment: '{{proxy_environment}}'
 
 - name: extract release archive
   when: needs_installed
diff --git a/roles/yq/tasks/Debian.yaml b/roles/yq/tasks/Debian.yaml
index 55314aa..50395c6 100644
--- a/roles/yq/tasks/Debian.yaml
+++ b/roles/yq/tasks/Debian.yaml
@@ -36,3 +36,4 @@
     url: '{{asset.browser_download_url}}'
     dest: '{{yq_exe}}'
     mode: +x
+  environment: '{{proxy_environment}}'
diff --git a/roles/yq/tasks/RedHat.yaml b/roles/yq/tasks/RedHat.yaml
index 3223355..daec67b 100644
--- a/roles/yq/tasks/RedHat.yaml
+++ b/roles/yq/tasks/RedHat.yaml
@@ -50,3 +50,4 @@
     url: '{{asset.browser_download_url}}'
     dest: '{{ansible_env.HOME}}/.local/bin/yq'
     mode: '0755'
+  environment: '{{proxy_environment}}'