diff --git a/.envrc.sample b/.envrc.sample
index fd5b5dead..4b1c26f66 100644
--- a/.envrc.sample
+++ b/.envrc.sample
@@ -4,3 +4,5 @@ go env -w GOPRIVATE=coopcloud.tech
 # export HCLOUD_TOKEN=$(pass show logins/hetzner/cicd/api_key)
 # export CAPSUL_TOKEN=...
 # export GITEA_TOKEN=...
+# export DOCKER_USERNAME=...
+# export DOCKER_PASSWORD=...
diff --git a/pkg/client/registry.go b/pkg/client/registry.go
index eac7ab117..8d27c66f3 100644
--- a/pkg/client/registry.go
+++ b/pkg/client/registry.go
@@ -1,15 +1,20 @@
 package client
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
 	"net/http"
 	"strings"
+	"os"
 
 	"coopcloud.tech/abra/pkg/web"
 	"github.com/docker/distribution/reference"
 	"github.com/hashicorp/go-retryablehttp"
+	dockerClient "github.com/docker/docker/client"
+	"github.com/docker/docker/api/types"
+	"github.com/sirupsen/logrus"
 )
 
 type RawTag struct {
@@ -84,6 +89,20 @@ func GetTagDigest(image reference.Named) (string, error) {
 		return "", err
 	}
 
+	dClient := dockerClient.Client{}
+
+	username, username_ok := os.LookupEnv("DOCKER_USERNAME")
+	password, password_ok := os.LookupEnv("DOCKER_PASSWORD")
+	if username_ok && password_ok {
+		logrus.Debugf("docker login: %s, %s", username, password)
+		dClient.RegistryLogin(context.Background(), types.AuthConfig{
+			Username: username,
+			Password: password,
+			ServerAddress: "docker.io",
+		})
+		return "", nil
+	}
+
 	token, err := getRegv2Token(image)
 	if err != nil {
 		return "", err