diff --git a/live/secrets/terragrunt.hcl b/live/secrets/terragrunt.hcl
index c6ecbf8..992460b 100644
--- a/live/secrets/terragrunt.hcl
+++ b/live/secrets/terragrunt.hcl
@@ -26,6 +26,37 @@ locals {
 
   secrets = try(local.secret_values_env.secrets, [])
 
+  # image-pull-secret (regcred) fan-out. Single source: vault.common.regcred.dockerconfigjson.
+  # Rolled as a kubernetes.io/dockerconfigjson secret named `regcred` into every
+  # namespace flagged `image_pull_secret: true` in infrastructure.yaml. Only created
+  # when the source is a real docker config (guards against the CHANGE_ME placeholder).
+  regcred_dockerconfigjson = try(local.secret_values_env.vault.common.regcred.dockerconfigjson, "")
+  regcred_valid            = can(jsondecode(local.regcred_dockerconfigjson))
+  regcred_namespaces = [
+    for ns in try(local.infra_config.environments[local.env_name].namespaces, []) :
+    ns.name if try(ns.image_pull_secret, false)
+  ]
+  regcred_secrets = local.regcred_valid ? [
+    for ns in local.regcred_namespaces : {
+      name            = "regcred"
+      namespace       = ns
+      type            = "dockerconfigjson"
+      registry_url    = ""
+      data            = { ".dockerconfigjson" = base64encode(local.regcred_dockerconfigjson) }
+      depends_on      = {}
+      yc_sa_key_names = {}
+      custom_keys     = {}
+      constant_keys   = {}
+      random_keys     = {}
+      credential_keys = {}
+      labels          = {}
+      annotations     = {}
+      ignore_changes  = false
+      sink            = "k8s"
+      vault_path      = ""
+    }
+  ] : []
+
   secrets_input = [
     for secret in local.secrets : {
       name            = secret.name
@@ -105,7 +136,7 @@ terraform {
 }
 
 inputs = {
-  secrets = local.secrets_input
+  secrets = concat(local.secrets_input, local.regcred_secrets)
 
   s3_outputs = {
     bucket_name = dependency.s3.outputs.bucket_name
diff --git a/modules/k8s-namespace/variables.tf b/modules/k8s-namespace/variables.tf
index a3c5912..ab7a615 100644
--- a/modules/k8s-namespace/variables.tf
+++ b/modules/k8s-namespace/variables.tf
@@ -4,5 +4,8 @@ variable "namespaces" {
     name        = string
     labels      = optional(map(string), {})
     annotations = optional(map(string), {})
+    # When true, the secrets stack rolls the common regcred (dockerconfigjson)
+    # into this namespace. Not used by the namespace module itself.
+    image_pull_secret = optional(bool, false)
   }))
 }