Checkout submodule from different Azure DEvOps organization

Question

In my YAML pipeline I'm trying to checkout a submodule which is stored in a different Azure DevOps organization repository as described here. I generated a PAT token, prefixed it with pat: and base64 encoded.

My .gitmodules looks as follows:

[submodule "infrastructure/common"]
    path = infrastructure/common
    url = https://<ORG-NAME>@dev.azure.com/<ORG-NAME>/<PROJECT>/_git/<REPO-NAME>

My yaml looks as follows:

   - checkout: self
     submodules: false

   - script: |
       git -c http.https://<ORG-NAME>@dev.azure.com/<ORG-NAME>/<PROJECT>/_git/<REPO-NAME>.extraheader="AUTHORIZATION: Basic <BASE64_ENCODED_PAT>" submodule update --init --recursive

However, in my Azure DEvOPS pipeline I'm still getting: fatal: could not read Password for 'https://[email protected]': terminal prompts disabled

It seems that git doesn't know to use PAT and expects a password. I tried removing ORG-NAME from the repo url in gitmodules, but then I get similar error asking for username.