diff --git a/README.md b/README.md
index e11549da..79cfe517 100644
--- a/README.md
+++ b/README.md
@@ -241,6 +241,11 @@ This behavior can be disabled by setting the environment variable `BAZELISK_SKIP
 
 You can control the user agent that Bazelisk sends in all HTTP requests by setting `BAZELISK_USER_AGENT` to the desired value.
 
+You can set the Authorization header that Bazelisk sends in all HTTP requests by setting `BAZELISK_AUTH_HEADER` to the desired value.
+```shell
+export BAZELISK_AUTH_HEADER="Bearer <your_token_here>"
+```
+
 # .bazeliskrc configuration file
 
 A `.bazeliskrc` file in the root directory of a workspace or the user home directory allows users to set environment variables persistently. (The Python implementation of Bazelisk doesn't check the user home directory yet, only the workspace directory.)
@@ -269,6 +274,7 @@ The following variables can be set:
 - `BAZELISK_SHUTDOWN`
 - `BAZELISK_SKIP_WRAPPER`
 - `BAZELISK_USER_AGENT`
+- `BAZELISK_AUTH_HEADER`
 - `BAZELISK_VERIFY_SHA256`
 - `USE_BAZEL_VERSION`
 
diff --git a/core/core.go b/core/core.go
index 2fcaad8e..a926c63b 100644
--- a/core/core.go
+++ b/core/core.go
@@ -106,6 +106,7 @@ func RunBazeliskWithArgsFuncAndConfigAndOut(argsFunc ArgsFunc, repos *Repositori
 // repositories and config, writing its stdout and stderr to the passed writers.
 func RunBazeliskWithArgsFuncAndConfigAndOutAndErr(argsFunc ArgsFunc, repos *Repositories, config config.Config, stdout, stderr io.Writer) (int, error) {
 	httputil.UserAgent = getUserAgent(config)
+	httputil.AuthHeader = getAuthHeader(config)
 
 	// bazeliskVersion command must be the only argument
 	if len(os.Args[1:]) == 1 && os.Args[1] == "bazeliskVersion" {
@@ -324,6 +325,10 @@ func getUserAgent(config config.Config) string {
 	return fmt.Sprintf("Bazelisk/%s", BazeliskVersion)
 }
 
+func getAuthHeader(config config.Config) string {
+	return config.Get("BAZELISK_AUTH_HEADER")
+}
+
 // GetBazelVersion returns the Bazel version that should be used.
 func GetBazelVersion(config config.Config) (string, error) {
 	// Check in this order:
diff --git a/httputil/httputil.go b/httputil/httputil.go
index 0103d29b..e12e5b32 100644
--- a/httputil/httputil.go
+++ b/httputil/httputil.go
@@ -28,6 +28,8 @@ var (
 	DefaultTransport = http.DefaultTransport
 	// UserAgent is passed to every HTTP request as part of the 'User-Agent' header.
 	UserAgent   = "Bazelisk"
+	// AuthHeader is optionally set to a value that is passed as part of the 'Authorization' header in HTTP requests.
+	AuthHeader  = ""
 	linkPattern = regexp.MustCompile(`<(.*?)>; rel="(\w+)"`)
 
 	// RetryClock is used for waiting between HTTP request retries.
@@ -215,10 +217,16 @@ func DownloadBinary(originURL, destDir, destFile string, config config.Config) (
 		log.Printf("Downloading %s...", originURL)
 
 		var auth string = ""
-		t, err := tryFindNetrcFileCreds(u.Host)
-		if err == nil {
-			// successfully parsed netrc for given host
-			auth = t
+		if AuthHeader != "" {
+			// If AuthHeader is set, use it as the Authorization header.
+			log.Printf("Authorization header is set using BAZELISK_AUTH_HEADER, using it for %s", u.Host)
+			auth = AuthHeader
+		} else {
+			t, err := tryFindNetrcFileCreds(u.Host)
+			if err == nil {
+				// successfully parsed netrc for given host
+				auth = t
+			}
 		}
 
 		resp, err := get(originURL, auth)