I think I recall seeing something on the GitHub forums where the recommended approach was the create a separate service user account and all your non-personal-PATs with that account.