diff --git a/bin/generate-secrets b/bin/generate-secrets
index 719c9838..eb102aa8 100755
--- a/bin/generate-secrets
+++ b/bin/generate-secrets
@@ -88,6 +88,8 @@ zenith_registrar_subdomain_token_signing_key: "$(openssl rand -hex 32)"
 harbor_admin_password: "$(openssl rand -hex 16)"
 # The secret key for Harbor
 harbor_secret_key: "$(openssl rand -hex 8)"
+# The password for harbor "dockerproxy" account
+harbor_proxy_password: "$(openssl rand -hex 16)"
 
 # https://azimuth-config.readthedocs.io/en/stable/configuration/14-monitoring/#accessing-web-interfaces
 # The admin password for Azimuth administrative dashboards
diff --git a/environments/base/inventory/group_vars/all.yml b/environments/base/inventory/group_vars/all.yml
index 4b7299ef..02956414 100644
--- a/environments/base/inventory/group_vars/all.yml
+++ b/environments/base/inventory/group_vars/all.yml
@@ -63,6 +63,12 @@ harbor_proxy_cache_extra_projects: { }
 harbor_proxy_cache_projects: >-
   {{ harbor_proxy_cache_default_projects | combine(harbor_proxy_cache_extra_projects) }}
 
+capi_cluster_registry_auth:
+  - registry_url: "registry.{{ ingress_base_domain }}.dockerhub-public"
+    basic_auth:
+      username: proxy
+      password: "{{ harbor_proxy_password }}"
+
 # Indicates whether to install a Grafana to show cloud metrics
 cloud_metrics_enabled: false