Unable to check out submodules

We have 2FA enabled on our accounts and so I followed this guide to configure our VCS root to use SSH to authenticate to GitHub. Our main repository has a submodule reference and when we attempt to build in TeamCity we get the following error:

Failed to collect changes, error: Error collecting changes for VCS repository '"GitHub" {instance id=111, parent internal id=5, parent id=GitHub, description: "git@github.com:MyOrg/my-main-repo.git#refs/heads/develop"}' Collecting changes failed: jetbrains.buildServer.buildTriggers.vcs.git.submodules.SubmoduleFetchException: Cannot fetch the 'https://github.com/MyOrg/my-submodule.git' repository used as a submodule at the 'my-submodule' path in the 'git@github.com:MyOrg/my-main-repo.git' repository in the c84724f0aa012820cecd120641403c0e8feaa622 commit, cause: jetbrains.buildServer.vcs.VcsException: 'git fetch' command failed. stderr: Error while pruning removed branches: https://github.com/MyOrg/my-submodule.git: not authorized org.eclipse.jgit.errors.TransportException: https://github.com/MyOrg/my-submodule.git: not authorized at org.eclipse.jgit.transport.TransportHttp.connect(TransportHttp.java:511) at org.eclipse.jgit.transport...

My understanding is that the root VCS authentication settings should also be used for the submodule. My .gitmodules file is as follows:

[submodule "my-submodule"]
path = my-submodule
url = https://github.com/MyOrg/my-submodule.git
branch = develop

I found that if I change the submodule url to use the SSH URL it does work but with the side effect that it requires all of our developers to switch to using SSH - and most of them are still using username/password auth.

Please advise on the suggested setup for submodules on GitHub accounts with 2FA enabled.