diff --git a/src/VCS/Adapter/Git.php b/src/VCS/Adapter/Git.php
index 51f3201c..83f7c07d 100644
--- a/src/VCS/Adapter/Git.php
+++ b/src/VCS/Adapter/Git.php
@@ -126,6 +126,28 @@ public function supportsRepositoryArchives(): bool
         return true;
     }
 
+    /**
+     * Git HTTPS URL of a repository, for a consumer that clones instead of
+     * downloading an archive. Carries no credentials - they ride the headers
+     * from getRepositoryCloneHeaders(), never a string that errors and logs
+     * echo verbatim.
+     */
+    public function getRepositoryCloneUrl(string $owner, string $repositoryName): string
+    {
+        throw new Exception('getRepositoryCloneUrl() is not supported by ' . $this->getName());
+    }
+
+    /**
+     * Headers authenticating a fetch of getRepositoryCloneUrl(), typically
+     * Authorization. Empty when the repository needs none.
+     *
+     * @return array<string, string>
+     */
+    public function getRepositoryCloneHeaders(): array
+    {
+        return [];
+    }
+
     /**
      * Whether images embedded in pull request comments can render on the
      * provider. Providers without an image proxy (the way GitHub rewrites
diff --git a/src/VCS/Adapter/Git/Origin.php b/src/VCS/Adapter/Git/Origin.php
index 96646055..91cf04fd 100644
--- a/src/VCS/Adapter/Git/Origin.php
+++ b/src/VCS/Adapter/Git/Origin.php
@@ -1706,6 +1706,31 @@ public function supportsRepositoryArchives(): bool
         return false;
     }
 
+    /**
+     * Git HTTPS URL of a repository. Origin serves content over Git HTTPS
+     * only, so this is the URL consumers clone instead of downloading an
+     * archive.
+     */
+    public function getRepositoryCloneUrl(string $owner, string $repositoryName): string
+    {
+        return $this->gitEndpoint . '/' . \urlencode($owner) . '/' . \urlencode($repositoryName) . '.git';
+    }
+
+    /**
+     * Origin's Git endpoint takes HTTP Basic credentials with the fixed
+     * username x-access-token and the installation token as the password.
+     *
+     * @return array<string, string>
+     */
+    public function getRepositoryCloneHeaders(): array
+    {
+        if (empty($this->accessToken)) {
+            return [];
+        }
+
+        return ['Authorization' => 'Basic ' . \base64_encode('x-access-token:' . $this->accessToken)];
+    }
+
     /**
      * Origin renders comment markdown without proxying images, so images on
      * a consumer's own host cannot display; comments should stay textual.