diff --git a/nixos/modules/services/continuous-integration/github-runner/options.nix b/nixos/modules/services/continuous-integration/github-runner/options.nix
index cb1020b7eab9..23436c2adf71 100644
--- a/nixos/modules/services/continuous-integration/github-runner/options.nix
+++ b/nixos/modules/services/continuous-integration/github-runner/options.nix
@@ -102,6 +102,30 @@
               example = "/run/secrets/github-runner/nixos.token";
             };
 
+            tokenType = lib.mkOption {
+              type = lib.types.enum [
+                "auto"
+                "access"
+                "registration"
+              ];
+              description = ''
+                Type of token to use for runner registration.
+
+                An access token is a personal access token or any other kind of GitHub token that
+                starts with `ghp_`, `gho_`, etc prefix. It is passed as `--pat` to the runner
+                config script.
+
+                A registration token is an unprefixed string generated by the
+                "Add new self-hosted runner" page. It is passed as `--token` to runner config
+                script.
+
+                The default `auto` attempts to detect the token type automatically based on its
+                format.
+              '';
+              example = "registration";
+              default = "auto";
+            };
+
             name = lib.mkOption {
               type = lib.types.nullOr lib.types.str;
               description = ''
diff --git a/nixos/modules/services/continuous-integration/github-runner/service.nix b/nixos/modules/services/continuous-integration/github-runner/service.nix
index aaf8083dc5b9..2a0720a6b0c7 100644
--- a/nixos/modules/services/continuous-integration/github-runner/service.nix
+++ b/nixos/modules/services/continuous-integration/github-runner/service.nix
@@ -184,14 +184,25 @@
                           ${lib.optionalString cfg.ephemeral "--ephemeral"}
                           ${lib.optionalString cfg.noDefaultLabels "--no-default-labels"}
                         )
-                        # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
-                        # if it is not a PAT, we assume it contains a registration token and use the --token option
                         token=$(<"${newConfigTokenPath}")
-                        if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
+                        case ${cfg.tokenType} in
+                        access)
                           args+=(--pat "$token")
-                        else
+                          ;;
+                        registration)
                           args+=(--token "$token")
-                        fi
+                          ;;
+                        auto)
+                          # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"),
+                          # we have to use the --pat option, if it is not a PAT, we assume it contains a
+                          # registration token and use the --token option
+                          if [[ "$token" =~ ^gh[a-z]+_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
+                            args+=(--pat "$token")
+                          else
+                            args+=(--token "$token")
+                          fi
+                          ;;
+                        esac
                         ${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
                         # Move the automatically created _diag dir to the logs dir
                         mkdir -p  "$STATE_DIRECTORY/_diag"