diff --git a/scripts/ci/sccache-start.sh b/scripts/ci/sccache-start.sh
index 103dba7769c45f303b6b90005d5501a454536f7c..8a27d2252483f5222726320d79b7bafef24b1308 100755
--- a/scripts/ci/sccache-start.sh
+++ b/scripts/ci/sccache-start.sh
@@ -34,3 +34,17 @@ if [ "${attempts}" = 0 ]; then
   echo "Could not start sccache after ${max_attempts}, running without sccache."
   export RUSTC_WRAPPER=""
 fi
+
+# get access to GCS backend to store the cache on protected branches
+if [ "$CI_COMMIT_REF_PROTECTED" = "true" ]; then
+  echo "### Logging into protected repo ..."
+  echo "${GCP_PROTECTED_SERVICE_ACCOUNT}" | base64 -d > protected_sa.json
+  gcloud auth activate-service-account --key-file=protected_sa.json
+
+  #
+  GOOGLE_OAUTH_ACCESS_TOKEN=$(gcloud auth print-access-token)
+  export GOOGLE_OAUTH_ACCESS_TOKEN
+else
+  echo "### Logging into standard repo ..."
+  # Nothing to do
+fi