diff --git a/extensions/ql-vscode/CHANGELOG.md b/extensions/ql-vscode/CHANGELOG.md
index 25e4b778868..1b0dd387ead 100644
--- a/extensions/ql-vscode/CHANGELOG.md
+++ b/extensions/ql-vscode/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## [UNRELEASED]
 
+- Always authenticate when downloading databases from GitHub, instead of only when in canary mode. [#3941](https://github.com/github/vscode-codeql/pull/3941)
+
 ## 1.17.1 - 23 January 2025
 
 - Remove support for CodeQL CLI versions older than 2.18.4. [#3895](https://github.com/github/vscode-codeql/pull/3895)
diff --git a/extensions/ql-vscode/src/databases/database-fetcher.ts b/extensions/ql-vscode/src/databases/database-fetcher.ts
index 0934bab6b70..d474f2d63e0 100644
--- a/extensions/ql-vscode/src/databases/database-fetcher.ts
+++ b/extensions/ql-vscode/src/databases/database-fetcher.ts
@@ -28,11 +28,8 @@ import {
   allowHttp,
   downloadTimeout,
   getGitHubInstanceUrl,
-  hasGhecDrUri,
-  isCanary,
 } from "../config";
 import { showAndLogInformationMessage } from "../common/logging";
-import { AppOctokit } from "../common/octokit";
 import type { DatabaseOrigin } from "./local-databases/database-origin";
 import { createTimeoutSignal } from "../common/fetch-stream";
 import type { App } from "../common/app";
@@ -187,12 +184,7 @@ export class DatabaseFetcher {
       throw new Error(`Invalid GitHub repository: ${githubRepo}`);
     }
 
-    const credentials =
-      isCanary() || hasGhecDrUri() ? this.app.credentials : undefined;
-
-    const octokit = credentials
-      ? await credentials.getOctokit()
-      : new AppOctokit();
+    const octokit = await this.app.credentials.getOctokit();
 
     const result = await convertGithubNwoToDatabaseUrl(
       nwo,