diff --git a/api/v1alpha1/privateloadzone_types.go b/api/v1alpha1/privateloadzone_types.go
index bb1de716..fa033441 100644
--- a/api/v1alpha1/privateloadzone_types.go
+++ b/api/v1alpha1/privateloadzone_types.go
@@ -32,11 +32,12 @@ import (
 
 // PrivateLoadZoneSpec defines the desired state of PrivateLoadZone
 type PrivateLoadZoneSpec struct {
-	Token              string                      `json:"token"`
-	Resources          corev1.ResourceRequirements `json:"resources"`
-	ServiceAccountName string                      `json:"serviceAccountName,omitempty"`
-	NodeSelector       map[string]string           `json:"nodeSelector,omitempty"`
-	Image              string                      `json:"image,omitempty"`
+	Token              string                        `json:"token"`
+	Resources          corev1.ResourceRequirements   `json:"resources"`
+	ServiceAccountName string                        `json:"serviceAccountName,omitempty"`
+	NodeSelector       map[string]string             `json:"nodeSelector,omitempty"`
+	Image              string                        `json:"image,omitempty"`
+	ImagePullSecrets   []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
 }
 
 // PrivateLoadZoneStatus defines the observed state of PrivateLoadZone
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index ffc2f65e..e65a4851 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -387,6 +387,11 @@ func (in *PrivateLoadZoneSpec) DeepCopyInto(out *PrivateLoadZoneSpec) {
 			(*out)[key] = val
 		}
 	}
+	if in.ImagePullSecrets != nil {
+		in, out := &in.ImagePullSecrets, &out.ImagePullSecrets
+		*out = make([]v1.LocalObjectReference, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrivateLoadZoneSpec.
diff --git a/config/crd/bases/k6.io_privateloadzones.yaml b/config/crd/bases/k6.io_privateloadzones.yaml
index 8084fecc..3ce91732 100644
--- a/config/crd/bases/k6.io_privateloadzones.yaml
+++ b/config/crd/bases/k6.io_privateloadzones.yaml
@@ -28,6 +28,14 @@ spec:
             properties:
               image:
                 type: string
+              imagePullSecrets:
+                items:
+                  properties:
+                    name:
+                      type: string
+                  type: object
+                  x-kubernetes-map-type: atomic
+                type: array
               nodeSelector:
                 additionalProperties:
                   type: string
diff --git a/pkg/testrun/plz.go b/pkg/testrun/plz.go
index 683d52a9..bbe42ef7 100644
--- a/pkg/testrun/plz.go
+++ b/pkg/testrun/plz.go
@@ -47,6 +47,7 @@ func NewPLZTestRun(plz *v1alpha1.PrivateLoadZone, trData *cloud.TestRunData, ing
 		Spec: v1alpha1.TestRunSpec{
 			Runner: v1alpha1.Pod{
 				Image:              trData.RunnerImage,
+				ImagePullSecrets:   plz.Spec.ImagePullSecrets,
 				ServiceAccountName: plz.Spec.ServiceAccountName,
 				NodeSelector:       plz.Spec.NodeSelector,
 				Resources:          plz.Spec.Resources,
@@ -64,6 +65,7 @@ func NewPLZTestRun(plz *v1alpha1.PrivateLoadZone, trData *cloud.TestRunData, ing
 			Starter: v1alpha1.Pod{
 				ServiceAccountName: plz.Spec.ServiceAccountName,
 				NodeSelector:       plz.Spec.NodeSelector,
+				ImagePullSecrets:   plz.Spec.ImagePullSecrets,
 			},
 			Script: v1alpha1.K6Script{
 				LocalFile: "/test/archive.tar",
diff --git a/pkg/types/script.go b/pkg/types/script.go
index e8f99bd9..3ccdbc66 100644
--- a/pkg/types/script.go
+++ b/pkg/types/script.go
@@ -10,7 +10,7 @@ import (
 // Internal type created to support Spec.script options
 type Script struct {
 	Name     string // Name of ConfigMap or VolumeClaim or "LocalFile"
-	ReadOnly bool // VolumeClaim only
+	ReadOnly bool   // VolumeClaim only
 	Filename string
 	Path     string
 	Type     string // ConfigMap | VolumeClaim | LocalFile