diff --git a/pipeline/frontend/yaml/compiler/compiler.go b/pipeline/frontend/yaml/compiler/compiler.go
index 7525fff28..be8e6ffe4 100644
--- a/pipeline/frontend/yaml/compiler/compiler.go
+++ b/pipeline/frontend/yaml/compiler/compiler.go
@@ -237,6 +237,14 @@ func (c *Compiler) Compile(conf *yaml_types.Workflow) (*backend_types.Config, er
 			stepType = backend_types.StepTypePlugin
 		}
 		step := c.createProcess(name, container, stepType)
+
+		// inject netrc if it's a trusted repo or a trusted clone-plugin
+		if c.trustedPipeline || (container.IsPlugin() && container.IsTrustedCloneImage()) {
+			for k, v := range c.cloneEnv {
+				step.Environment[k] = v
+			}
+		}
+
 		stage.Steps = append(stage.Steps, step)
 	}