diff --git a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.test.ts b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.test.ts
index 0ec65b7a0b..57c2b3345b 100644
--- a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.test.ts
+++ b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.test.ts
@@ -16,6 +16,7 @@
 
 import { CatalogApi } from '@backstage/catalog-client';
 import { UserEntity } from '@backstage/catalog-model';
+import { TokenIssuer } from '../../identity';
 import { CatalogIdentityClient } from './CatalogIdentityClient';
 
 describe('CatalogIdentityClient', () => {
@@ -29,25 +30,36 @@ describe('CatalogIdentityClient', () => {
     getLocationByEntity: jest.fn(),
     removeEntityByUid: jest.fn(),
   };
+  const tokenIssuer: jest.Mocked<TokenIssuer> = {
+    issueToken: jest.fn(),
+    listPublicKeys: jest.fn(),
+  };
 
   afterEach(() => jest.resetAllMocks());
 
   it('passes through the correct search params', async () => {
     catalogApi.getEntities.mockResolvedValueOnce({ items: [{} as UserEntity] });
+    tokenIssuer.issueToken.mockResolvedValue('my-token');
     const client = new CatalogIdentityClient({
-      catalogApi: catalogApi as CatalogApi,
+      catalogApi: catalogApi,
+      tokenIssuer: tokenIssuer,
     });
 
-    client.findUser({ annotations: { key: 'value' } });
+    await client.findUser({ annotations: { key: 'value' } });
 
-    expect(catalogApi.getEntities).toBeCalledWith(
+    expect(catalogApi.getEntities).toHaveBeenCalledWith(
       {
         filter: {
           kind: 'user',
           'metadata.annotations.key': 'value',
         },
       },
-      undefined,
+      { token: 'my-token' },
     );
+    expect(tokenIssuer.issueToken).toHaveBeenCalledWith({
+      claims: {
+        sub: 'backstage.io/auth-backend',
+      },
+    });
   });
 });
diff --git a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
index abd3624df2..947b8dac1f 100644
--- a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
+++ b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
@@ -17,6 +17,7 @@
 import { ConflictError, NotFoundError } from '@backstage/errors';
 import { CatalogApi } from '@backstage/catalog-client';
 import { UserEntity } from '@backstage/catalog-model';
+import { TokenIssuer } from '../../identity';
 
 type UserQuery = {
   annotations: Record<string, string>;
@@ -27,9 +28,11 @@ type UserQuery = {
  */
 export class CatalogIdentityClient {
   private readonly catalogApi: CatalogApi;
+  private readonly tokenIssuer: TokenIssuer;
 
-  constructor(options: { catalogApi: CatalogApi }) {
+  constructor(options: { catalogApi: CatalogApi; tokenIssuer: TokenIssuer }) {
     this.catalogApi = options.catalogApi;
+    this.tokenIssuer = options.tokenIssuer;
   }
 
   /**
@@ -37,10 +40,7 @@ export class CatalogIdentityClient {
    *
    * Throws a NotFoundError or ConflictError if 0 or multiple users are found.
    */
-  async findUser(
-    query: UserQuery,
-    options?: { token?: string },
-  ): Promise<UserEntity> {
+  async findUser(query: UserQuery): Promise<UserEntity> {
     const filter: Record<string, string> = {
       kind: 'user',
     };
@@ -48,7 +48,11 @@ export class CatalogIdentityClient {
       filter[`metadata.annotations.${key}`] = value;
     }
 
-    const { items } = await this.catalogApi.getEntities({ filter }, options);
+    // TODO(Rugvip): cache the token
+    const token = await this.tokenIssuer.issueToken({
+      claims: { sub: 'backstage.io/auth-backend' },
+    });
+    const { items } = await this.catalogApi.getEntities({ filter }, { token });
 
     if (items.length !== 1) {
       if (items.length > 1) {