diff --git a/deploy/infrabox/templates/function_crd.yaml b/deploy/infrabox/templates/function_crd.yaml
index 7e2821b99..f1b5b9044 100644
--- a/deploy/infrabox/templates/function_crd.yaml
+++ b/deploy/infrabox/templates/function_crd.yaml
@@ -33,6 +33,11 @@ spec:
         mountPath: /etc/ssl/certs/saprootca.pem
         name: dockerd-config
         subPath: rootca.pem
+{{ end }}
+{{- if .Values.job.docker_config_secret }}
+    -
+        mountPath: /root/.docker
+        name: docker-config
 {{ end }}
     -
         name: data-dir
@@ -50,6 +55,12 @@ spec:
         name: dockerd-config
         configMap:
             name: infrabox-dockerd-config
+{{- if .Values.job.docker_config_secret }}
+    -
+        name: docker-config
+        secret:
+            secretName: {{ .Values.job.docker_config_secret }}
+{{ end }}
 {{ if .Values.local_cache.enabled }}
     -
         name: local-cache
diff --git a/deploy/infrabox/values.yaml b/deploy/infrabox/values.yaml
index f6fe8f978..071366fb1 100644
--- a/deploy/infrabox/values.yaml
+++ b/deploy/infrabox/values.yaml
@@ -360,6 +360,11 @@ job:
         {}
 
     storage_driver: overlay
+    # Name of a K8s Secret (in infrabox-worker namespace) containing a config.json
+    # key with pre-authenticated docker credentials. Allows job containers to pull
+    # from private registries without explicit docker login.
+    # The secret can be managed via ExternalSecret synced from Vault.
+    docker_config_secret: ""
     #rootca_pem: |- # Using base64 encoded string to put the cert in one line