diff --git a/.github/workflows/selfdrive_tests.yaml b/.github/workflows/selfdrive_tests.yaml
index 9b2b565547..854faf4545 100644
--- a/.github/workflows/selfdrive_tests.yaml
+++ b/.github/workflows/selfdrive_tests.yaml
@@ -78,6 +78,7 @@ jobs:
         submodules: true
     - uses: ./.github/workflows/setup-with-retry
       with:
+        docker_hub_pat: ${{ secrets.DOCKER_HUB_PAT }}
         cache_key_prefix: scons_${{ matrix.arch }}
     - uses: ./.github/workflows/compile-openpilot
       timeout-minutes: ${{ ((steps.restore-scons-cache.outputs.cache-hit == 'true') && 15 || 30) }} # allow more time when we missed the scons cache
@@ -177,6 +178,7 @@ jobs:
         sudo rm -rf /Applications/ArmGNUToolchain/*/*/.fseventsd
 
   docker_push:
+    name: docker push
     strategy:
       matrix:
         arch: ${{ fromJson( (github.repository == 'commaai/openpilot') && '["x86_64", "aarch64"]' || '["x86_64"]' ) }}
@@ -194,6 +196,7 @@ jobs:
     - uses: ./.github/workflows/setup-with-retry
       with:
         git-lfs: false
+        docker_hub_pat: ${{ secrets.DOCKER_HUB_PAT }}
     - name: Build and push CL Docker image
       if: matrix.arch == 'x86_64'
       run: |
@@ -280,6 +283,8 @@ jobs:
       with:
         submodules: true
     - uses: ./.github/workflows/setup-with-retry
+      with:
+        docker_hub_pat: ${{ secrets.DOCKER_HUB_PAT }}
     - name: Cache test routes
       id: dependency-cache
       uses: actions/cache@v3
diff --git a/.github/workflows/setup-with-retry/action.yaml b/.github/workflows/setup-with-retry/action.yaml
index e4c97af3ce..159778211d 100644
--- a/.github/workflows/setup-with-retry/action.yaml
+++ b/.github/workflows/setup-with-retry/action.yaml
@@ -1,6 +1,10 @@
 name: 'openpilot env setup, with retry on failure'
 
 inputs:
+  docker_hub_pat:
+    description: 'Auth token for Docker Hub, required for BuildJet jobs'
+    required: false
+    default: ''
   git_lfs:
     description: 'Whether or not to pull the git lfs'
     required: false
@@ -21,6 +25,7 @@ runs:
       uses: ./.github/workflows/setup
       continue-on-error: true
       with:
+        docker_hub_pat: ${{ inputs.docker_hub_pat }}
         git_lfs: ${{ inputs.git_lfs }}
         cache_key_prefix: ${{ inputs.cache_key_prefix }}
         is_retried: true
@@ -32,6 +37,7 @@ runs:
       uses: ./.github/workflows/setup
       continue-on-error: true
       with:
+        docker_hub_pat: ${{ inputs.docker_hub_pat }}
         git_lfs: ${{ inputs.git_lfs }}
         cache_key_prefix: ${{ inputs.cache_key_prefix }}
         is_retried: true
@@ -42,6 +48,7 @@ runs:
       if: steps.setup2.outcome == 'failure'
       uses: ./.github/workflows/setup
       with:
+        docker_hub_pat: ${{ inputs.docker_hub_pat }}
         git_lfs: ${{ inputs.git_lfs }}
         cache_key_prefix: ${{ inputs.cache_key_prefix }}
         is_retried: true
diff --git a/.github/workflows/setup/action.yaml b/.github/workflows/setup/action.yaml
index eebc376346..d00f968b5c 100644
--- a/.github/workflows/setup/action.yaml
+++ b/.github/workflows/setup/action.yaml
@@ -1,13 +1,17 @@
 name: 'openpilot env setup'
 
 inputs:
+  docker_hub_pat:
+    description: 'Auth token for Docker Hub, required for BuildJet jobs'
+    required: true
+    default: ''
   git_lfs:
     description: 'Whether or not to pull the git lfs'
-    required: false
+    required: true
     default: 'true'
   cache_key_prefix:
     description: 'Prefix for caching key'
-    required: false
+    required: true
     default: 'scons_x86_64'
   is_retried:
     description: 'A mock param that asserts that we use the setup-with-retry instead of this action directly'
@@ -29,6 +33,19 @@ runs:
       if: ${{ inputs.git_lfs == 'true' }}
       run: git lfs pull
 
+    # on BuildJet runners, must be logged into DockerHub to avoid rate limiting
+    # https://buildjet.com/for-github-actions/docs/guides/docker
+    - shell: bash
+      if: ${{ contains(runner.name, 'buildjet') && inputs.docker_hub_pat == '' }}
+      run: |
+        echo "Need to set the Docker Hub PAT secret as an input to this action"
+        exit 1
+    - name: Login to Docker Hub
+      if: contains(runner.name, 'buildjet')
+      shell: bash
+      run: |
+        docker login -u adeebshihadeh -p ${{ inputs.docker_hub_pat }}
+
     # build cache
     - id: date
       shell: bash