diff --git a/.changelog/4210.txt b/.changelog/4210.txt
new file mode 100644
index 0000000000..37ae8a9776
--- /dev/null
+++ b/.changelog/4210.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+helm: adds imagePullSecret to the gateway-resources job and the gateway-cleanup job, would fail before if the image was in a private registry
+```
diff --git a/charts/consul/templates/gateway-cleanup-serviceaccount.yaml b/charts/consul/templates/gateway-cleanup-serviceaccount.yaml
index f50eb72d97..52c340f69d 100644
--- a/charts/consul/templates/gateway-cleanup-serviceaccount.yaml
+++ b/charts/consul/templates/gateway-cleanup-serviceaccount.yaml
@@ -10,4 +10,10 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
     component: gateway-cleanup
+{{- with .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range . }}
+  - name: {{ .name }}
+{{- end }}
+{{- end }}
 {{- end }}
diff --git a/charts/consul/templates/gateway-resources-serviceaccount.yaml b/charts/consul/templates/gateway-resources-serviceaccount.yaml
index 4611dc38e1..db3a44984f 100644
--- a/charts/consul/templates/gateway-resources-serviceaccount.yaml
+++ b/charts/consul/templates/gateway-resources-serviceaccount.yaml
@@ -10,4 +10,10 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
     component: gateway-resources
+{{- with .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range . }}
+  - name: {{ .name }}
+{{- end }}
+{{- end }}
 {{- end }}
diff --git a/charts/consul/test/unit/gateway-cleanup-serviceaccount.bats b/charts/consul/test/unit/gateway-cleanup-serviceaccount.bats
index 50d01b99e9..62b4ecf320 100644
--- a/charts/consul/test/unit/gateway-cleanup-serviceaccount.bats
+++ b/charts/consul/test/unit/gateway-cleanup-serviceaccount.bats
@@ -21,3 +21,25 @@ target=templates/gateway-cleanup-serviceaccount.yaml
         . 
 }
 
+#--------------------------------------------------------------------
+# global.imagePullSecrets
+
+@test "gatewaycleanup/ServiceAccount: can set image pull secrets" {
+  cd `chart_dir`
+  local object=$(helm template \
+      -s templates/gateway-cleanup-serviceaccount.yaml  \
+      --set 'connectInject.enabled=true' \
+      --set 'global.imagePullSecrets[0].name=my-secret' \
+      --set 'global.imagePullSecrets[1].name=my-secret2' \
+      . | tee /dev/stderr)
+
+  local actual=$(echo "$object" |
+      yq -r '.imagePullSecrets[0].name' | tee /dev/stderr)
+  [ "${actual}" = "my-secret" ]
+
+  local actual=$(echo "$object" |
+      yq -r '.imagePullSecrets[1].name' | tee /dev/stderr)
+  [ "${actual}" = "my-secret2" ]
+}
+
+
diff --git a/charts/consul/test/unit/gateway-resources-serviceaccount.bats b/charts/consul/test/unit/gateway-resources-serviceaccount.bats
index 90011e226b..60c1d06ded 100644
--- a/charts/consul/test/unit/gateway-resources-serviceaccount.bats
+++ b/charts/consul/test/unit/gateway-resources-serviceaccount.bats
@@ -21,3 +21,23 @@ target=templates/gateway-resources-serviceaccount.yaml
         . 
 }
 
+#--------------------------------------------------------------------
+# global.imagePullSecrets
+
+@test "gatewayresources/ServiceAccount: can set image pull secrets" {
+  cd `chart_dir`
+  local object=$(helm template \
+      -s templates/gateway-resources-serviceaccount.yaml  \
+      --set 'connectInject.enabled=true' \
+      --set 'global.imagePullSecrets[0].name=my-secret' \
+      --set 'global.imagePullSecrets[1].name=my-secret2' \
+      . | tee /dev/stderr)
+
+  local actual=$(echo "$object" |
+      yq -r '.imagePullSecrets[0].name' | tee /dev/stderr)
+  [ "${actual}" = "my-secret" ]
+
+  local actual=$(echo "$object" |
+      yq -r '.imagePullSecrets[1].name' | tee /dev/stderr)
+  [ "${actual}" = "my-secret2" ]
+}