diff --git a/deploy/flux/icarus-mngt/secrets/.env.d/.gitignore b/deploy/flux/icarus-mngt/secrets/.env.d/.gitignore
index d29675e..205c0ac 100644
--- a/deploy/flux/icarus-mngt/secrets/.env.d/.gitignore
+++ b/deploy/flux/icarus-mngt/secrets/.env.d/.gitignore
@@ -1,2 +1,3 @@
 **
-!.gitignore
\ No newline at end of file
+!.gitignore
+!**.example.**
\ No newline at end of file
diff --git a/deploy/flux/icarus-mngt/secrets/.env.d/oci-registry-secret.example.json b/deploy/flux/icarus-mngt/secrets/.env.d/oci-registry-secret.example.json
new file mode 100644
index 0000000..5ae7f99
--- /dev/null
+++ b/deploy/flux/icarus-mngt/secrets/.env.d/oci-registry-secret.example.json
@@ -0,0 +1,8 @@
+{
+    "auths": {
+        "xxx.xxx.con": {
+            "username": "xxxx",
+            "password": "xxxx"
+        }
+    }
+}
\ No newline at end of file
diff --git a/deploy/flux/icarus-mngt/secrets/kustomization.yaml b/deploy/flux/icarus-mngt/secrets/kustomization.yaml
index 201f480..cfcdd25 100644
--- a/deploy/flux/icarus-mngt/secrets/kustomization.yaml
+++ b/deploy/flux/icarus-mngt/secrets/kustomization.yaml
@@ -11,6 +11,9 @@ secretGenerator:
     files:
       - vault-pass.txt=.env.d/ansible-vault-pass.txt
       - ansible_become_password=.env.d/ansible_become_password
+  - name: oci-registry-secret
+    files:
+      - .dockerconfigjson=.env.d/oci-registry-secret.json
 generatorOptions:
   disableNameSuffixHash: true
 
diff --git a/deploy/icarus-mngt/workflowTemplates/icarus-ansible-script.yaml b/deploy/icarus-mngt/workflowTemplates/icarus-ansible-script.yaml
index 6a9b9c3..7641d7a 100644
--- a/deploy/icarus-mngt/workflowTemplates/icarus-ansible-script.yaml
+++ b/deploy/icarus-mngt/workflowTemplates/icarus-ansible-script.yaml
@@ -10,9 +10,8 @@ metadata:
 spec:
   serviceAccountName: argo-runner
   imagePullSecrets:
-    - name: oci-mylimbo-infra-icarus-credentials
+    - name: oci-registry-secret
   entrypoint: raw-source
-
   templates:
     - name: raw-source
       inputs:
diff --git a/icarus-mngt/workflows/tests-download-private-oci.yaml b/icarus-mngt/workflows/tests-download-private-oci.yaml
new file mode 100644
index 0000000..98516a8
--- /dev/null
+++ b/icarus-mngt/workflows/tests-download-private-oci.yaml
@@ -0,0 +1,38 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: tests-download-private-oci-
+  namespace: icarus-nodes-mngt  
+  labels:
+    workflows.argoproj.io/archive-strategy: "false"
+  annotations:
+    workflows.argoproj.io/description: |
+      tests
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  imagePullSecrets:
+  - name: oci-registry-secret
+  templates:
+    - name: exec
+      script:
+        image: alpine:latest
+        command: ["sh"] 
+        source: |
+          #!/bin/sh
+          ls -lah /mnt
+        resources:
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+        volumeMounts:
+          - name: oci-image
+            mountPath: /mnt
+      volumes:
+      - name: oci-image
+        image:
+          reference: oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest 
+          pullPolicy: Always