diff --git a/README.md b/README.md
index f73bbcda..6d7bf8fb 100644
--- a/README.md
+++ b/README.md
@@ -221,6 +221,11 @@ This behavior can be disabled by setting the environment variable `BAZELISK_SKIP
 
 You can control the user agent that Bazelisk sends in all HTTP requests by setting `BAZELISK_USER_AGENT` to the desired value.
 
+You can set the Authorization header that Bazelisk sends in all HTTP requests by setting `BAZELISK_AUTH_HEADER` to the desired value.
+```shell
+export BAZELISK_AUTH_HEADER="Bearer <your_token_here>"
+```
+
 On Windows, Bazelisk will also consider the following files in addition to `tools/bazel`:
 
 * `tools/bazel.ps1` (PowerShell)
@@ -254,6 +259,7 @@ The following variables can be set:
 - `BAZELISK_SHUTDOWN`
 - `BAZELISK_SKIP_WRAPPER`
 - `BAZELISK_USER_AGENT`
+- `BAZELISK_AUTH_HEADER`
 - `BAZELISK_VERIFY_SHA256`
 - `USE_BAZEL_VERSION`
 
diff --git a/core/core.go b/core/core.go
index ee8d1154..f7daa056 100644
--- a/core/core.go
+++ b/core/core.go
@@ -99,6 +99,7 @@ func RunBazeliskWithArgsFuncAndConfig(argsFunc ArgsFunc, repos *Repositories, co
 // repositories and config, writing its stdout to the passed writer.
 func RunBazeliskWithArgsFuncAndConfigAndOut(argsFunc ArgsFunc, repos *Repositories, config config.Config, out io.Writer) (int, error) {
 	httputil.UserAgent = getUserAgent(config)
+	httputil.AuthHeader = getAuthHeader(config)
 
 	bazelInstallation, err := GetBazelInstallation(repos, config)
 	if err != nil {
@@ -300,6 +301,14 @@ func getUserAgent(config config.Config) string {
 	return fmt.Sprintf("Bazelisk/%s", BazeliskVersion)
 }
 
+func getAuthHeader(config config.Config) string {
+	auth_header := config.Get("BAZELISK_AUTH_HEADER")
+	if len(auth_header) > 0 {
+		return auth_header
+	}
+	return ""
+}
+
 // GetBazelVersion returns the Bazel version that should be used.
 func GetBazelVersion(config config.Config) (string, error) {
 	// Check in this order:
diff --git a/httputil/httputil.go b/httputil/httputil.go
index c020e064..7f0b617f 100644
--- a/httputil/httputil.go
+++ b/httputil/httputil.go
@@ -27,6 +27,8 @@ var (
 	DefaultTransport = http.DefaultTransport
 	// UserAgent is passed to every HTTP request as part of the 'User-Agent' header.
 	UserAgent   = "Bazelisk"
+	// AuthHeader is optionally set to a value that is passed as part of the 'Authorization' header in HTTP requests.
+	AuthHeader  = ""
 	linkPattern = regexp.MustCompile(`<(.*?)>; rel="(\w+)"`)
 
 	// RetryClock is used for waiting between HTTP request retries.
@@ -213,10 +215,16 @@ func DownloadBinary(originURL, destDir, destFile string, config config.Config) (
 		log.Printf("Downloading %s...", originURL)
 
 		var auth string = ""
-		t, err := tryFindNetrcFileCreds(u.Host)
-		if err == nil {
-			// successfully parsed netrc for given host
-			auth = t
+		if AuthHeader != "" {
+			// If AuthHeader is set, use it as the Authorization header.
+			log.Printf("Authorization header is set using BAZELISK_AUTH_HEADER, using it for %s", u.Host)
+			auth = AuthHeader
+		} else {
+			t, err := tryFindNetrcFileCreds(u.Host)
+			if err == nil {
+				// successfully parsed netrc for given host
+				auth = t
+			}
 		}
 
 		resp, err := get(originURL, auth)