diff --git a/.changeset/curvy-years-smoke.md b/.changeset/curvy-years-smoke.md
new file mode 100644
index 0000000000..056056fdff
--- /dev/null
+++ b/.changeset/curvy-years-smoke.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder': patch
+---
+
+Forward `Authorization` header for `EventSource` when credentials are available.
diff --git a/plugins/scaffolder/package.json b/plugins/scaffolder/package.json
index 4b5e34e5de..a80ecec049 100644
--- a/plugins/scaffolder/package.json
+++ b/plugins/scaffolder/package.json
@@ -74,6 +74,7 @@
     "@types/react": "^16.13.1 || ^17.0.0",
     "@uiw/react-codemirror": "^4.9.3",
     "classnames": "^2.2.6",
+    "event-source-polyfill": "^1.0.31",
     "git-url-parse": "^13.0.0",
     "humanize-duration": "^3.25.1",
     "immer": "^9.0.1",
@@ -108,7 +109,6 @@
     "@types/json-schema": "^7.0.9",
     "@types/node": "^16.11.26",
     "cross-fetch": "^3.1.5",
-    "event-source-polyfill": "1.0.25",
     "msw": "^1.0.0"
   },
   "files": [
diff --git a/plugins/scaffolder/src/api.test.ts b/plugins/scaffolder/src/api.test.ts
index e21bda8fd7..b9b1881066 100644
--- a/plugins/scaffolder/src/api.test.ts
+++ b/plugins/scaffolder/src/api.test.ts
@@ -20,11 +20,14 @@ import { MockFetchApi, setupRequestMockHandlers } from '@backstage/test-utils';
 import { rest } from 'msw';
 import { setupServer } from 'msw/node';
 import { ScaffolderClient } from './api';
+import { EventSourcePolyfill } from 'event-source-polyfill';
 
-const MockedEventSource = global.EventSource as jest.MockedClass<
-  typeof EventSource
+const MockedEventSource = EventSourcePolyfill as jest.MockedClass<
+  typeof EventSourcePolyfill
 >;
 
+jest.mock('event-source-polyfill');
+
 const server = setupServer();
 
 describe('api', () => {
@@ -102,6 +105,9 @@ describe('api', () => {
           },
         );
 
+        const token = 'fake-token';
+        identityApi.getCredentials.mockResolvedValue({ token: token });
+
         const next = jest.fn();
 
         await new Promise<void>(complete => {
@@ -112,7 +118,10 @@ describe('api', () => {
 
         expect(MockedEventSource).toHaveBeenCalledWith(
           'http://backstage/api/v2/tasks/a-random-task-id/eventstream',
-          { withCredentials: true },
+          {
+            withCredentials: true,
+            headers: { Authorization: `Bearer ${token}` },
+          },
         );
         expect(MockedEventSource.prototype.close).toHaveBeenCalled();
 
diff --git a/plugins/scaffolder/src/api.ts b/plugins/scaffolder/src/api.ts
index 7a3f6c14bb..c67a5c944e 100644
--- a/plugins/scaffolder/src/api.ts
+++ b/plugins/scaffolder/src/api.ts
@@ -41,6 +41,7 @@ import {
 } from '@backstage/plugin-scaffolder-react';
 
 import queryString from 'qs';
+import { EventSourcePolyfill } from 'event-source-polyfill';
 
 /**
  * An API to interact with the scaffolder backend.
@@ -224,8 +225,11 @@ export class ScaffolderClient implements ScaffolderApi {
         params.set('after', String(Number(after)));
       }
 
-      this.discoveryApi.getBaseUrl('scaffolder').then(
-        baseUrl => {
+      Promise.all([
+        this.discoveryApi.getBaseUrl('scaffolder'),
+        this.identityApi?.getCredentials(),
+      ]).then(
+        ([baseUrl, credentials]) => {
           const url = `${baseUrl}/v2/tasks/${encodeURIComponent(
             taskId,
           )}/eventstream`;
@@ -240,7 +244,12 @@ export class ScaffolderClient implements ScaffolderApi {
             }
           };
 
-          const eventSource = new EventSource(url, { withCredentials: true });
+          const eventSource = new EventSourcePolyfill(url, {
+            withCredentials: true,
+            headers: credentials?.token
+              ? { Authorization: `Bearer ${credentials.token}` }
+              : {},
+          });
           eventSource.addEventListener('log', processEvent);
           eventSource.addEventListener('cancelled', processEvent);
           eventSource.addEventListener('completion', (event: any) => {
diff --git a/yarn.lock b/yarn.lock
index e38ea3fff3..bcfa6ab89d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8658,7 +8658,7 @@ __metadata:
     "@uiw/react-codemirror": ^4.9.3
     classnames: ^2.2.6
     cross-fetch: ^3.1.5
-    event-source-polyfill: 1.0.25
+    event-source-polyfill: ^1.0.31
     git-url-parse: ^13.0.0
     humanize-duration: ^3.25.1
     immer: ^9.0.1
@@ -23845,6 +23845,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"event-source-polyfill@npm:^1.0.31":
+  version: 1.0.31
+  resolution: "event-source-polyfill@npm:1.0.31"
+  checksum: 973f226404e2a1b14ed7ef15c718b89e213b41d7cfeeb1c10937fd09229f13904f3d7c3075ab28ccf858c213007559908eecdd577577330352f53a351383dd75
+  languageName: node
+  linkType: hard
+
 "event-stream@npm:=3.3.4":
   version: 3.3.4
   resolution: "event-stream@npm:3.3.4"