diff --git a/packages/backend/package.json b/packages/backend/package.json
index aa00407952..8d215d5137 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -28,6 +28,7 @@
   },
   "dependencies": {
     "@backstage/backend-common": "^0.5.1",
+    "@backstage/catalog-client": "^0.3.5",
     "@backstage/catalog-model": "^0.7.0",
     "@backstage/config": "^0.1.2",
     "@backstage/plugin-app-backend": "^0.3.5",
diff --git a/packages/backend/src/plugins/scaffolder.ts b/packages/backend/src/plugins/scaffolder.ts
index 4e2257a46c..bd3616116b 100644
--- a/packages/backend/src/plugins/scaffolder.ts
+++ b/packages/backend/src/plugins/scaffolder.ts
@@ -24,6 +24,7 @@ import {
   CatalogEntityClient,
 } from '@backstage/plugin-scaffolder-backend';
 import { SingleHostDiscovery } from '@backstage/backend-common';
+import { CatalogClient } from '@backstage/catalog-client';
 import type { PluginEnvironment } from '../types';
 import Docker from 'dockerode';
 
@@ -44,7 +45,8 @@ export default async function createPlugin({
   const dockerClient = new Docker();
 
   const discovery = SingleHostDiscovery.fromConfig(config);
-  const entityClient = new CatalogEntityClient({ discovery });
+  const catalogClient = new CatalogClient({ discoveryApi: discovery });
+  const entityClient = new CatalogEntityClient({ catalogClient });
 
   return await createRouter({
     preparers,
diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json
index 7af9f567e3..c9a439bea3 100644
--- a/plugins/scaffolder-backend/package.json
+++ b/plugins/scaffolder-backend/package.json
@@ -30,6 +30,7 @@
   },
   "dependencies": {
     "@backstage/backend-common": "^0.5.1",
+    "@backstage/catalog-client": "^0.3.4",
     "@backstage/catalog-model": "^0.7.0",
     "@backstage/config": "^0.1.2",
     "@backstage/integration": "^0.3.1",
diff --git a/plugins/scaffolder-backend/src/lib/catalog/CatalogEntityClient.ts b/plugins/scaffolder-backend/src/lib/catalog/CatalogEntityClient.ts
index c5e20202c5..6c2909d360 100644
--- a/plugins/scaffolder-backend/src/lib/catalog/CatalogEntityClient.ts
+++ b/plugins/scaffolder-backend/src/lib/catalog/CatalogEntityClient.ts
@@ -14,22 +14,18 @@
  * limitations under the License.
  */
 
-import fetch from 'cross-fetch';
 import { TemplateEntityV1alpha1 } from '@backstage/catalog-model';
-import {
-  ConflictError,
-  NotFoundError,
-  PluginEndpointDiscovery,
-} from '@backstage/backend-common';
+import { CatalogClient } from '@backstage/catalog-client';
+import { ConflictError, NotFoundError } from '@backstage/backend-common';
 
 /**
  * A catalog client tailored for reading out entity data from the catalog.
  */
 export class CatalogEntityClient {
-  private readonly discovery: PluginEndpointDiscovery;
+  private readonly catalogClient: CatalogClient;
 
-  constructor(options: { discovery: PluginEndpointDiscovery }) {
-    this.discovery = options.discovery;
+  constructor(options: { catalogClient: CatalogClient }) {
+    this.catalogClient = options.catalogClient;
   }
 
   /**
@@ -38,32 +34,15 @@ export class CatalogEntityClient {
    * Throws a NotFoundError or ConflictError if 0 or multiple templates are found.
    */
   async findTemplate(
+    token: string | undefined,
     templateName: string,
-    options?: { headers?: Record<string, string> },
   ): Promise<TemplateEntityV1alpha1> {
-    const conditions = [
-      'kind=template',
-      `metadata.name=${encodeURIComponent(templateName)}`,
-    ];
-
-    const baseUrl = await this.discovery.getBaseUrl('catalog');
-    const response = await fetch(
-      `${baseUrl}/entities?filter=${conditions.join(',')}`,
-      {
-        headers: {
-          ...options?.headers,
-        },
+    const { items: templates } = (await this.catalogClient.getEntities(token, {
+      filter: {
+        kind: 'template',
+        'metadata.name': templateName,
       },
-    );
-
-    if (!response.ok) {
-      const text = await response.text();
-      throw new Error(
-        `Request failed with ${response.status} ${response.statusText}, ${text}`,
-      );
-    }
-
-    const templates: TemplateEntityV1alpha1[] = await response.json();
+    })) as { items: TemplateEntityV1alpha1[] };
 
     if (templates.length !== 1) {
       if (templates.length > 1) {
diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index 070b7cffc7..606aa05bc1 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -15,6 +15,7 @@
  */
 
 import { Config } from '@backstage/config';
+import { BackstageIdentity } from '@backstage/core';
 import Docker from 'dockerode';
 import express from 'express';
 import { resolve as resolvePath } from 'path';
@@ -97,12 +98,12 @@ export async function createRouter(
         },
       };
 
-      // Forward authorization header from client
-      const template = await entityClient.findTemplate(templateName, {
-        headers: req.headers.authorization
-          ? { authorization: req.headers.authorization }
-          : {},
-      });
+      // Forward authorization from client
+      const user = req.user as BackstageIdentity;
+      const template = await entityClient.findTemplate(
+        user?.idToken,
+        templateName,
+      );
 
       const validationResult: ValidatorResult = validate(
         values,