diff --git a/app/imageswap/imageswap.py b/app/imageswap/imageswap.py
index 3976cab..f330c14 100755
--- a/app/imageswap/imageswap.py
+++ b/app/imageswap/imageswap.py
@@ -37,6 +37,8 @@
 imageswap_disable_label = os.getenv("IMAGESWAP_DISABLE_LABEL", "k8s.twr.io/imageswap")
 imageswap_mode = os.getenv("IMAGESWAP_MODE", "MAPS")
 imageswap_maps_file = os.getenv("IMAGESWAP_MAPS_FILE", "/app/maps/imageswap-maps.conf")
+imageswap_default_image_pull_secret = os.getenv("IMAGESWAP_DEFAULT_IMAGE_PULL_SECRET", None)
+imageswap_always_add_default_ips = os.getenv("IMAGESWAP_ALWAYS_ADD_DEFAULT_IPS", "true").lower() == "true"
 imageswap_maps_default_key = "default"
 imageswap_maps_wildcard_key = "noswap_wildcards"
 imageswap_exact_keyword = "[EXACT]"
@@ -59,6 +61,22 @@
 ################################################################################
 
 
+def addImagePullSecrets(imagePullSecrets, default_image_pull_secret):
+    """
+    check imagePullSecrets in format
+
+    [ {"name": "secret1"}, {"name", "secret2"} ]
+
+    whether there is an entry with name == default_image_pull_secret, if not add it to the list
+    """
+    for secret in imagePullSecrets:
+        if secret.get("name") == default_image_pull_secret:
+            return False
+    app.logger.info(f'adding default image pull secret "{default_image_pull_secret}" to imagePullSecrets')
+    imagePullSecrets.append({"name": default_image_pull_secret})
+    return True
+
+
 @app.route("/", methods=["POST"])
 def mutate():
 
@@ -119,6 +137,15 @@ def mutate():
 
                     app.logger.info(f"Processing init-container: {namespace}/{workload}")
                     needs_patch = swap_image(init_container_spec) or needs_patch
+            
+            if imageswap_default_image_pull_secret:
+                if "imagePullSecrets" in modified_spec["request"]["object"]["spec"]:
+                    imagePullSecrets = modified_spec["request"]["object"]["spec"]["imagePullSecrets"]
+                    needs_patch = addImagePullSecrets(imagePullSecrets, imageswap_default_image_pull_secret) or needs_patch
+                elif imageswap_always_add_default_ips:
+                    app.logger.info(f'"imagePullSecrets" not present, force-adding default image pull secret "{imageswap_default_image_pull_secret}"')
+                    modified_spec["request"]["object"]["spec"]["imagePullSecrets"] = [{"name": imageswap_default_image_pull_secret}]
+                    needs_patch = True
 
         else:
 
@@ -134,6 +161,15 @@ def mutate():
                     app.logger.info(f"Processing init-container: {namespace}/{workload}")
                     needs_patch = swap_image(init_container_spec) or needs_patch
 
+            if imageswap_default_image_pull_secret:
+                if "imagePullSecrets" in modified_spec["request"]["object"]["spec"]["template"]["spec"]:
+                    imagePullSecrets = modified_spec["request"]["object"]["spec"]["template"]["spec"]["imagePullSecrets"]
+                    needs_patch = addImagePullSecrets(imagePullSecrets, imageswap_default_image_pull_secret) or needs_patch
+                elif imageswap_always_add_default_ips:
+                    app.logger.info(f'"imagePullSecrets" not present, force-adding default image pull secret "{imageswap_default_image_pull_secret}"')
+                    modified_spec["request"]["object"]["spec"]["template"]["spec"]["imagePullSecrets"] = [{"name": imageswap_default_image_pull_secret}]
+                    needs_patch = True
+
     if needs_patch:
 
         app.logger.debug("Needs patch")