accessing $(System.AccessToken) in yaml pipeline

I have a pipeline and a azure-pipelines.yml that drives my build, that requires a PAT in order for the build script to push artifacts using nuget, by using "nuget sources add.." this works! but my PAT is in the script, which is bad, and the PAT will eventually expire, so I'd much rather use $(System.AccessToken), but I can't get it to work, there seems a lot of related questions, but I simply don't understand what I'm not doing.

This is the working yaml (with fake PAT)

name: $(Rev:r)

trigger:
- master

jobs:
- job: Windows
  pool:
    vmImage: 'windows-2019'
  steps:
  - task: NuGetToolInstaller@1
  - task: UseDotNet@2
    inputs:
      packageType: 'sdk'
      version: '3.1.201'        
  - script: dotnet tool restore
    displayName: Install FAKE
  - script: nuget sources add -name "Kookerella2" -source https://pkgs.dev.azure.com/..../index.json -username anything -password thisismypat
    displayName: nuget add source
  - script: dotnet fake build
    displayName: Run Build

and to use $(System.AccessToken)

I do this? replacing the hardcoded pat with an environment variable %SYSTEM_ACCESSTOKEN% (you have to scroll to the far right to see) but this fails!

name: $(Rev:r)

trigger:
- master

jobs:
- job: Windows
  pool:
    vmImage: 'windows-2019'
  steps:
  - task: NuGetToolInstaller@1
  - task: UseDotNet@2
    inputs:
      packageType: 'sdk'
      version: '3.1.201'        
  - script: dotnet tool restore
    displayName: Install FAKE
  - script: nuget sources add -name "Kookerella2" -source https://pkgs.dev.azure.com/Kookerella2/_packaging/Kookerella2/nuget/v3/index.json -username anything -password %SYSTEM_ACCESSTOKEN%
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
    displayName: nuget add source
  - script: dotnet fake build
    displayName: Run Build

Am I doing something stupid?

based on feedback I've tried to use

$env:SYSTEM_ACCESSTOKEN

this failed, (I'm pretty sure that script defaults to the command prompt).

I then tried

  - powershell: nuget sources add -name "Kookerella2" -source https://pkgs.dev.azure.com/Kookerella2/_packaging/Kookerella2/nuget/v3/index.json -username anything -password $env:SYSTEM_ACCESSTOKEN
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

which failed in the nuget push in the build with

Response status code does not indicate success: 403 (Forbidden - User '123a17e0-1d16-4a98-a124-435fda808ac6' lacks permission to complete this action. You need to have 'AddPackage'. (DevOps Activity ID: 4CCE5D91-5279-4782-BF9F-00279A087C6E)).

I do have

"project collection build service (Kookerella2) -> Contributor"

set under my artifacts permissions

the solution is marked below. Summary is...there is NOTHING wrong with the orignal YAML, %SYSTEM_ACCESSTOKEN% is valid for a command prompt, and works...ONCE you "allow project scoped builds" in the permissions of the artifacts (see below). Why? I have no clue....but thats a luxury.