diff --git a/docker.Makefile b/docker.Makefile
index b860c3b..8575dde 100644
--- a/docker.Makefile
+++ b/docker.Makefile
@@ -59,6 +59,7 @@ push-$(RUNTIME)-%: .build/tag-$(RUNTIME)-%
 	$(DOCKER_BUILD) \
 		$(patsubst %,--build-arg BASE_IMAGE=%,$(BASE_IMAGE)) \
 		$(patsubst %,--build-arg PHP_BASE_IMAGE=%,$(PHP_BASE_IMAGE)) \
+		--build-arg COMPOSER_AUTH= \
 		-t local$@ \
 		--cache-from $(REGISTRY):$(@:.build/$(RUNTIME)-%=%) \
 		--cache-from $(REGISTRY):$(@:.build/$(RUNTIME)-%=%)$(TAG_SUFFIX_SLUG) \
diff --git a/wordpress/Dockerfile-bedrock-build b/wordpress/Dockerfile-bedrock-build
index de23007..500fd72 100644
--- a/wordpress/Dockerfile-bedrock-build
+++ b/wordpress/Dockerfile-bedrock-build
@@ -1,11 +1,16 @@
 ARG BASE_IMAGE=quay.io/presslabs/wordpress-runtime:bedrock
 FROM ${BASE_IMAGE} as bedrock
 WORKDIR /src
+
+# Inject custom env vars as build args
+ONBUILD ARG COMPOSER_AUTH
+ONBUILD ENV COMPOSER_AUTH ${COMPOSER_AUTH}
+
 # Install project dependencies as first build step for child images so that we
 # heat up composer cache
 ONBUILD COPY --chown=www-data:www-data composer.json composer.lock /src/
-ONBUILD RUN composer install --no-dev --no-interaction --no-progress --no-ansi --no-scripts
+ONBUILD RUN COMPOSER_AUTH=${COMPOSER_AUTH} composer install --no-dev --no-interaction --no-progress --no-ansi --no-scripts
 
 ONBUILD COPY --chown=www-data:www-data . /src
-ONBUILD RUN composer install --no-dev --no-interaction --no-progress --no-ansi --no-scripts
+ONBUILD RUN COMPOSER_AUTH=${COMPOSER_AUTH} composer install --no-dev --no-interaction --no-progress --no-ansi --no-scripts
 ONBUILD RUN cp -a /src/. /app