diff --git a/Cargo.lock b/Cargo.lock
index 900dac5d4..2dab7a91a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2266,6 +2266,7 @@ dependencies = [
  "async_timing_util",
  "aws-config",
  "aws-sdk-ec2",
+ "aws_ecr",
  "axum 0.7.5",
  "axum-extra",
  "base64 0.22.1",
diff --git a/bin/core/Cargo.toml b/bin/core/Cargo.toml
index 39e3a8259..7efbc8c9c 100644
--- a/bin/core/Cargo.toml
+++ b/bin/core/Cargo.toml
@@ -18,6 +18,7 @@ path = "src/main.rs"
 monitor_client = { workspace = true, features = ["mongo"] }
 periphery_client.workspace = true
 formatting.workspace = true
+aws_ecr.workspace = true
 logger.workspace = true
 git.workspace = true
 # mogh
diff --git a/bin/core/Dockerfile b/bin/core/Dockerfile
index 8645a0d82..f82ae16f5 100644
--- a/bin/core/Dockerfile
+++ b/bin/core/Dockerfile
@@ -16,8 +16,11 @@ RUN cd frontend && yarn link @monitor/client && yarn && yarn build
 FROM debian:bookworm-slim
 
 # Install Deps
-RUN apt update && apt install -y git ca-certificates
-
+RUN apt update && apt install -y git curl ca-certificates && \
+	curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
+	unzip awscliv2.zip && \
+	./aws/install
+	
 # Copy
 COPY ./config_example/core.config.example.toml /config/config.toml
 COPY --from=core-builder /builder/target/release/core /
diff --git a/bin/core/src/api/execute/build.rs b/bin/core/src/api/execute/build.rs
index f60b0752a..776766197 100644
--- a/bin/core/src/api/execute/build.rs
+++ b/bin/core/src/api/execute/build.rs
@@ -76,7 +76,7 @@ impl Resolve<RunBuild, (User, Update)> for State {
     .await?;
 
     let (registry_token, aws_ecr) =
-      validate_account_extract_registry_token_aws_ecr(&build)?;
+      validate_account_extract_registry_token_aws_ecr(&build).await?;
 
     // get the action state for the build (or insert default).
     let action_state =
@@ -736,7 +736,7 @@ fn start_aws_builder_log(
 /// This will make sure that a build with non-none image registry has an account attached,
 /// and will check the core config for a token / aws ecr config matching requirements.
 /// Otherwise it is left to periphery.
-fn validate_account_extract_registry_token_aws_ecr(
+async fn validate_account_extract_registry_token_aws_ecr(
   build: &Build,
 ) -> anyhow::Result<(Option<String>, Option<AwsEcrConfig>)> {
   match &build.config.image_registry {
@@ -760,7 +760,25 @@ fn validate_account_extract_registry_token_aws_ecr(
       Ok((core_config().github_accounts.get(account).cloned(), None))
     }
     ImageRegistry::AwsEcr(label) => {
-      Ok((None, core_config().aws_ecr_registries.get(label).cloned()))
+      let config = core_config().aws_ecr_registries.get(label);
+      let token = match config {
+        Some(AwsEcrConfig {
+          region,
+          access_key_id,
+          secret_access_key,
+          ..
+        }) => Some(
+          aws_ecr::get_ecr_token(
+            region,
+            access_key_id,
+            secret_access_key,
+          )
+          .await
+          .context("failed to get aws ecr token")?,
+        ),
+        None => None,
+      };
+      Ok((token, config.cloned()))
     }
     ImageRegistry::Custom(_) => {
       Err(anyhow!("Custom image registry is not implemented"))