diff --git a/x-pack/plugins/ingest_manager/server/plugin.ts b/x-pack/plugins/ingest_manager/server/plugin.ts
index f3e7f5ef90c1c..ba4c1e6688e2a 100644
--- a/x-pack/plugins/ingest_manager/server/plugin.ts
+++ b/x-pack/plugins/ingest_manager/server/plugin.ts
@@ -12,7 +12,7 @@ import {
   PluginInitializerContext,
   SavedObjectsLegacyService,
 } from 'kibana/server';
-
+import { SavedObjectsClient } from '../../../../src/core/server';
 import { LicensingPluginSetup } from '../../licensing/server';
 import { EncryptedSavedObjectsPluginStart } from '../../encrypted_saved_objects/server';
 import { SecurityPluginSetup } from '../../security/server';
@@ -55,6 +55,7 @@ export interface IngestManagerAppContext {
   encryptedSavedObjects: EncryptedSavedObjectsPluginStart;
   security?: SecurityPluginSetup;
   config$?: Observable<IngestManagerConfigType>;
+  internalSavedObjectsClient: SavedObjectsClient;
 }
 
 export class IngestManagerPlugin implements Plugin {
@@ -133,10 +134,14 @@ export class IngestManagerPlugin implements Plugin {
       encryptedSavedObjects: EncryptedSavedObjectsPluginStart;
     }
   ) {
+    const internalSavedObjectsClient = new SavedObjectsClient(
+      core.savedObjects.createInternalRepository()
+    );
     appContextService.start({
       encryptedSavedObjects: plugins.encryptedSavedObjects,
       security: this.security,
       config$: this.config$,
+      internalSavedObjectsClient,
     });
   }
 
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts b/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
index 272bff439071c..7985f052899e7 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
@@ -24,6 +24,7 @@ import {
 } from '../../types';
 import * as AgentService from '../../services/agents';
 import * as APIKeyService from '../../services/api_keys';
+import { appContextService } from '../../services/app_context';
 
 export const getAgentHandler: RequestHandler<TypeOf<
   typeof GetOneAgentRequestSchema.params
@@ -162,7 +163,7 @@ export const postAgentCheckinHandler: RequestHandler<
   TypeOf<typeof PostAgentCheckinRequestSchema.body>
 > = async (context, request, response) => {
   try {
-    const soClient = context.core.savedObjects.client;
+    const soClient = appContextService.getInternalSavedObjectsClient();
     const callCluster = context.core.elasticsearch.adminClient.callAsCurrentUser;
     const res = await APIKeyService.verifyAccessApiKey({ headers: request.headers, callCluster });
     if (!res.valid) {
@@ -211,7 +212,7 @@ export const postAgentAcksHandler: RequestHandler<
   TypeOf<typeof PostAgentAcksRequestSchema.body>
 > = async (context, request, response) => {
   try {
-    const soClient = context.core.savedObjects.client;
+    const soClient = appContextService.getInternalSavedObjectsClient();
     const callCluster = context.core.elasticsearch.adminClient.callAsCurrentUser;
     const res = await APIKeyService.verifyAccessApiKey({ headers: request.headers, callCluster });
     if (!res.valid) {
@@ -253,7 +254,7 @@ export const postAgentEnrollHandler: RequestHandler<
   TypeOf<typeof PostAgentEnrollRequestSchema.body>
 > = async (context, request, response) => {
   try {
-    const soClient = context.core.savedObjects.client;
+    const soClient = appContextService.getInternalSavedObjectsClient();
     const callCluster = context.core.elasticsearch.adminClient.callAsCurrentUser;
     const res = await APIKeyService.verifyEnrollmentAPIKey({
       soClient,
diff --git a/x-pack/plugins/ingest_manager/server/services/app_context.ts b/x-pack/plugins/ingest_manager/server/services/app_context.ts
index 69a014fca37fb..65a3a50458ccc 100644
--- a/x-pack/plugins/ingest_manager/server/services/app_context.ts
+++ b/x-pack/plugins/ingest_manager/server/services/app_context.ts
@@ -5,6 +5,7 @@
  */
 import { BehaviorSubject, Observable } from 'rxjs';
 import { first } from 'rxjs/operators';
+import { SavedObjectsClientContract } from 'kibana/server';
 import { EncryptedSavedObjectsPluginStart } from '../../../encrypted_saved_objects/server';
 import { SecurityPluginSetup } from '../../../security/server';
 import { IngestManagerConfigType } from '../../common';
@@ -15,10 +16,12 @@ class AppContextService {
   private security: SecurityPluginSetup | undefined;
   private config$?: Observable<IngestManagerConfigType>;
   private configSubject$?: BehaviorSubject<IngestManagerConfigType>;
+  private internalSavedObjectsClient: SavedObjectsClientContract | undefined;
 
   public async start(appContext: IngestManagerAppContext) {
     this.encryptedSavedObjects = appContext.encryptedSavedObjects;
     this.security = appContext.security;
+    this.internalSavedObjectsClient = appContext.internalSavedObjectsClient;
 
     if (appContext.config$) {
       this.config$ = appContext.config$;
@@ -45,6 +48,13 @@ class AppContextService {
   public getConfig$() {
     return this.config$;
   }
+
+  public getInternalSavedObjectsClient() {
+    if (!this.internalSavedObjectsClient) {
+      throw new Error('No internal savedObjectsClient');
+    }
+    return this.internalSavedObjectsClient;
+  }
 }
 
 export const appContextService = new AppContextService();