diff --git a/.changeset/backend-token-authentication.md b/.changeset/backend-token-authentication.md
new file mode 100644
index 0000000000..3b0f016800
--- /dev/null
+++ b/.changeset/backend-token-authentication.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Make identity valid if subject of token is a backstage server-2-server auth token
diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index e40958c778..dfccc4dc43 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -94,14 +94,11 @@ function isSupportedTemplate(entity: TemplateEntityV1beta3) {
  * until someone explicitly passes an IdentityApi. When we have reasonable confidence that most backstage deployments
  * are using the IdentityApi, we can remove this function.
  */
-function buildDefaultIdentityClient({
-  logger,
-}: {
-  logger: Logger;
-}): IdentityApi {
+function buildDefaultIdentityClient(options: RouterOptions): IdentityApi {
   return {
     getIdentity: async ({ request }: IdentityApiGetIdentityRequest) => {
       const header = request.headers.authorization;
+      const { logger } = options;
 
       if (!header) {
         return undefined;
@@ -131,6 +128,10 @@ function buildDefaultIdentityClient({
           throw new TypeError('Expected string sub claim');
         }
 
+        if (sub === 'backstage-server') {
+          return undefined;
+        }
+
         // Check that it's a valid ref, otherwise this will throw.
         parseEntityRef(sub);
 
@@ -178,8 +179,7 @@ export async function createRouter(
   const logger = parentLogger.child({ plugin: 'scaffolder' });
 
   const identity: IdentityApi =
-    options.identity || buildDefaultIdentityClient({ logger });
-
+    options.identity || buildDefaultIdentityClient(options);
   const workingDirectory = await getWorkingDirectory(config, logger);
   const integrations = ScmIntegrations.fromConfig(config);