diff --git a/.changeset/tame-pianos-hunt.md b/.changeset/tame-pianos-hunt.md
new file mode 100644
index 0000000000..74475291ef
--- /dev/null
+++ b/.changeset/tame-pianos-hunt.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': patch
+---
+
+Added `pullOptions` to `DockerContainerRunner#runContainer` method to pass down options when pulling an image.
diff --git a/packages/backend-common/api-report.md b/packages/backend-common/api-report.md
index 55cb3b34dc..888bc1639c 100644
--- a/packages/backend-common/api-report.md
+++ b/packages/backend-common/api-report.md
@@ -642,6 +642,21 @@ export { PluginDatabaseManager };
 
 export { PluginEndpointDiscovery };
 
+// @public
+export interface PullOptions {
+  // (undocumented)
+  [key: string]: unknown;
+  // (undocumented)
+  authconfig?: {
+    username?: string;
+    password?: string;
+    auth?: string;
+    email?: string;
+    serveraddress?: string;
+    [key: string]: unknown;
+  };
+}
+
 // @public
 export type ReaderFactory = (options: {
   config: Config;
@@ -740,6 +755,7 @@ export type RunContainerOptions = {
   envVars?: Record<string, string>;
   pullImage?: boolean;
   defaultUser?: boolean;
+  pullOptions?: PullOptions;
 };
 
 export { SearchOptions };
diff --git a/packages/backend-common/src/util/ContainerRunner.ts b/packages/backend-common/src/util/ContainerRunner.ts
index 7dc12919b3..351a5da613 100644
--- a/packages/backend-common/src/util/ContainerRunner.ts
+++ b/packages/backend-common/src/util/ContainerRunner.ts
@@ -16,6 +16,25 @@
 
 import { Writable } from 'stream';
 
+/**
+ *   Allows defining access credentials for a registry
+ *   Follows dockerode auth configuration:
+ *   {@link https://github.com/apocas/dockerode?tab=readme-ov-file#pull-from-private-repos}
+ *
+ *   @public
+ */
+export interface PullOptions {
+  authconfig?: {
+    username?: string;
+    password?: string;
+    auth?: string;
+    email?: string;
+    serveraddress?: string;
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+}
+
 /**
  * Options passed to the {@link ContainerRunner.runContainer} method.
  *
@@ -31,6 +50,7 @@ export type RunContainerOptions = {
   envVars?: Record<string, string>;
   pullImage?: boolean;
   defaultUser?: boolean;
+  pullOptions?: PullOptions;
 };
 
 /**
diff --git a/packages/backend-common/src/util/DockerContainerRunner.test.ts b/packages/backend-common/src/util/DockerContainerRunner.test.ts
index 737bf3d178..f5d0e18480 100644
--- a/packages/backend-common/src/util/DockerContainerRunner.test.ts
+++ b/packages/backend-common/src/util/DockerContainerRunner.test.ts
@@ -83,6 +83,30 @@ describe('DockerContainerRunner', () => {
     expect(mockDocker.run).toHaveBeenCalled();
   });
 
+  it('should pull the docker container with authentication', async () => {
+    await containerTaskApi.runContainer({
+      imageName,
+      args,
+      pullOptions: {
+        authconfig: {
+          auth: 'aaaaaaaaa',
+        },
+      },
+    });
+
+    expect(mockDocker.pull).toHaveBeenCalledWith(
+      imageName,
+      {
+        authconfig: {
+          auth: 'aaaaaaaaa',
+        },
+      },
+      expect.any(Function),
+    );
+
+    expect(mockDocker.run).toHaveBeenCalled();
+  });
+
   it('should not pull the docker container when pullImage is false', async () => {
     await containerTaskApi.runContainer({
       imageName,
diff --git a/packages/backend-common/src/util/DockerContainerRunner.ts b/packages/backend-common/src/util/DockerContainerRunner.ts
index 986470eb98..89a17fff51 100644
--- a/packages/backend-common/src/util/DockerContainerRunner.ts
+++ b/packages/backend-common/src/util/DockerContainerRunner.ts
@@ -47,6 +47,7 @@ export class DockerContainerRunner implements ContainerRunner {
       envVars = {},
       pullImage = true,
       defaultUser = false,
+      pullOptions = {},
     } = options;
 
     // Show a better error message when Docker is unavailable.
@@ -61,7 +62,7 @@ export class DockerContainerRunner implements ContainerRunner {
 
     if (pullImage) {
       await new Promise<void>((resolve, reject) => {
-        this.dockerClient.pull(imageName, {}, (err, stream) => {
+        this.dockerClient.pull(imageName, pullOptions, (err, stream) => {
           if (err) return reject(err);
           stream.pipe(logStream, { end: false });
           stream.on('end', () => resolve());
diff --git a/packages/backend-common/src/util/index.ts b/packages/backend-common/src/util/index.ts
index 3e7b762519..39bade08be 100644
--- a/packages/backend-common/src/util/index.ts
+++ b/packages/backend-common/src/util/index.ts
@@ -14,7 +14,11 @@
  * limitations under the License.
  */
 
-export type { ContainerRunner, RunContainerOptions } from './ContainerRunner';
+export type {
+  ContainerRunner,
+  RunContainerOptions,
+  PullOptions,
+} from './ContainerRunner';
 export { DockerContainerRunner } from './DockerContainerRunner';
 export type {
   KubernetesContainerRunnerOptions,