Can't clone repo with LFS and Submodules using Tokens

I have a few Projects all in the same Group.
One of these projects, call it top_level uses git-lfs. It also has git submodule references to other projects within the same group.

I can clone this fine using a personal access token.

However, part of our pipeline runs some automated integration tests on a test server that needs to run an ansible-pull command on this repo (we use our own private runners, but use GitLab.com).

I tried using a Group level Deploy Token. This successfully cloned the repo and submodules, but failed to download the git-lfs objects (I don’t understand why this won’t work)

$ git lfs fetch
fetch: Fetching reference refs/heads/development
batch response: Repository or object not found: > Check that it exists and that you have proper access to it

I tried using a project level Access Token from the top_level project. This cloned the main repo successfully, and got the git-lfs objects, but failed to get the git submodules. (I can understand why this wouldn’t work)

Failed to init/update submodules: Submodule
remote: HTTP Basic: Access denied\nfatal: Authentication failed for

How can I clone this repo without resorting to creating a user account and setting up a Personal Access Token?

Apparently the Group Level deploy tokens failing to clone LFS objects is a known issue