diff --git a/packages/electron-builder-http/src/httpExecutor.ts b/packages/electron-builder-http/src/httpExecutor.ts
index 5a7b4c7047f..b33ed4f6267 100644
--- a/packages/electron-builder-http/src/httpExecutor.ts
+++ b/packages/electron-builder-http/src/httpExecutor.ts
@@ -129,7 +129,7 @@ export abstract class HttpExecutor<REQUEST_OPTS, REQUEST> {
           reject(new HttpError(response, isJson ? JSON.parse(data) : data))
         }
         else {
-          const pathname = (<any>options).pathname || options.path
+          const pathname = (<any>options).originalFilename || (<any>options).pathname || options.path
           if (data.length === 0) {
             resolve()
           }
@@ -309,7 +309,7 @@ export function dumpRequestOptions(options: RequestOptions): string {
 
 // requestOptions should be cloned already, modified in place
 function removeAuthHeader(requestOptions: RequestOptions): RequestOptions {
-  // github redirect to amazon s3 - avoid error "Only one auth mechanism allowed" 
+  // github redirect to amazon s3 - avoid error "Only one auth mechanism allowed"
   if (requestOptions.headers != null && (requestOptions.hostname || "").includes(".amazonaws.") && requestOptions.headers.Authorization != null && requestOptions.headers.Authorization.startsWith("token ")) {
     requestOptions.headers = Object.assign({}, requestOptions.headers)
     delete requestOptions.headers.Authorization
diff --git a/packages/electron-updater/src/PrivateGitHubProvider.ts b/packages/electron-updater/src/PrivateGitHubProvider.ts
index 3154217a640..2b413b4a762 100644
--- a/packages/electron-updater/src/PrivateGitHubProvider.ts
+++ b/packages/electron-updater/src/PrivateGitHubProvider.ts
@@ -1,3 +1,4 @@
+import { session } from "electron"
 import { HttpError, request } from "electron-builder-http"
 import { CancellationToken } from "electron-builder-http/out/CancellationToken"
 import { GithubOptions, UpdateInfo } from "electron-builder-http/out/publishOptions"
@@ -15,16 +16,18 @@ export interface PrivateGitHubUpdateInfo extends UpdateInfo {
 export class PrivateGitHubProvider extends BaseGitHubProvider<PrivateGitHubUpdateInfo> {
   constructor(options: GithubOptions, private readonly token: string) {
     super(options, "api.github.com")
+    this.addHeadersHook()
   }
-  
+
   async getLatestVersion(): Promise<PrivateGitHubUpdateInfo> {
     const basePath = this.basePath
     const cancellationToken = new CancellationToken()
     const channelFile = getChannelFilename(getDefaultChannelName())
-    
+
     const assets = await this.getLatestVersionInfo(basePath, cancellationToken)
     const requestOptions = Object.assign({
-      headers: this.configureHeaders("application/octet-stream")
+      headers: this.configureHeaders("application/octet-stream"),
+      originalFilename: channelFile
     }, parseUrl(assets.find(it => it.name == channelFile)!.url))
     let result: any
     try {
@@ -45,13 +48,25 @@ export class PrivateGitHubProvider extends BaseGitHubProvider<PrivateGitHubUpdat
     return result
   }
 
+  private addHeadersHook(): void {
+    const { protocol, hostname } = this.baseUrl
+    const filter = {
+      urls: [`${protocol}//${hostname}${this.basePath}/*`]
+    }
+    session.defaultSession.webRequest.onBeforeSendHeaders(filter, (details: WebRequestDetails, callback: Function) => {
+      if (!details.requestHeaders.hasOwnProperty("Authorization")) {
+        details.requestHeaders.Authorization = `token ${this.token}`
+      }
+      callback({cancel: false, requestHeaders: details.requestHeaders})
+    })
+  };
+
   private configureHeaders(accept: string) {
     return Object.assign({
-      Accept: accept,
-      Authorization: `token ${this.token}`,
+      Accept: accept
     }, this.requestHeaders)
   }
-  
+
   private async getLatestVersionInfo(basePath: string, cancellationToken: CancellationToken): Promise<Array<Asset>> {
     const requestOptions: RequestOptions = Object.assign({
       path: `${basePath}/latest`,
@@ -71,10 +86,9 @@ export class PrivateGitHubProvider extends BaseGitHubProvider<PrivateGitHubUpdat
 
   async getUpdateFile(versionInfo: PrivateGitHubUpdateInfo): Promise<FileInfo> {
     const headers = {
-      Accept: "application/octet-stream",
-      Authorization: `token ${this.token}`
+      Accept: "application/octet-stream"
     }
-    
+
     // space is not supported on GitHub
     if (getCurrentPlatform() === "darwin") {
       const info = <any>versionInfo
@@ -99,4 +113,17 @@ export class PrivateGitHubProvider extends BaseGitHubProvider<PrivateGitHubUpdat
 export interface Asset {
   name: string
   url: string
+}
+
+export interface HeaderList {
+  [key: string]: any
+}
+
+export interface WebRequestDetails {
+  id: number
+  url: string
+  method: string
+  resourceType: string
+  timestamp: number
+  requestHeaders: HeaderList
 }
\ No newline at end of file