diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
index 1a69f28fb6..7a2afcbaed 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
@@ -89,8 +89,10 @@ export type SerializedTaskEvent = {
  *
  * @public
  */
-export type TaskSecrets = {
-  token: string | undefined;
+export type TaskSecrets = JsonObject & {
+  /** @deprecated Use `backstageToken` instead */
+  token?: string;
+  backstageToken?: string;
 };
 
 /**
diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index 9d26857ab9..f4f7398c8a 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -232,6 +232,9 @@ export async function createRouter(
       }
 
       const result = await taskBroker.dispatch(taskSpec, {
+        ...req.body.secrets,
+        backstageToken: token,
+        // This is deprecated, but we need to support it for now if people are running their own task broker.
         token: token,
       });