diff --git a/bundles/bundles.go b/bundles/bundles.go
index 4b9868b..451717a 100644
--- a/bundles/bundles.go
+++ b/bundles/bundles.go
@@ -3,6 +3,7 @@ package bundles
 import (
 	"errors"
 	"fmt"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
@@ -25,6 +26,7 @@ type BundleConfig struct {
 	RootPath   string
 	LocalFile  bool
 	Auth       *registrytypes.AuthConfig
+	Transport  http.RoundTripper
 }
 
 // BundleOption defines a configuration option for a bundle.
@@ -84,6 +86,13 @@ func WithAuth(c *registrytypes.AuthConfig) BundleOption {
 	}
 }
 
+func WithTransport(t http.RoundTripper) BundleOption {
+	return func(bc *BundleConfig) error {
+		bc.Transport = t
+		return nil
+	}
+}
+
 func (bc *BundleConfig) extractRepo() (string, string, error) {
 	s := strings.Split(bc.Repository, "://")
 	if len(s) != 2 {
@@ -114,6 +123,7 @@ func defaultConfig() *BundleConfig {
 		RootPath:   "/",
 		Repository: "docker://quay.io/kairos/packages",
 		Auth:       nil,
+		Transport:  http.DefaultTransport,
 	}
 }
 
@@ -197,7 +207,7 @@ func (e OCIImageExtractor) Install(config *BundleConfig) error {
 	if e.Local {
 		img, err = tarball.ImageFromPath(target, nil)
 	} else {
-		img, err = utils.GetImage(target, utils.GetCurrentPlatform(), config.Auth)
+		img, err = utils.GetImage(target, utils.GetCurrentPlatform(), config.Auth, config.Transport)
 	}
 	if err != nil {
 		return err
@@ -226,7 +236,7 @@ func (e OCIImageRunner) Install(config *BundleConfig) error {
 	if e.Local {
 		img, err = tarball.ImageFromPath(target, nil)
 	} else {
-		img, err = utils.GetImage(target, utils.GetCurrentPlatform(), config.Auth)
+		img, err = utils.GetImage(target, utils.GetCurrentPlatform(), config.Auth, config.Transport)
 	}
 	if err != nil {
 		return err
diff --git a/utils/image.go b/utils/image.go
index 0793f7b..6673a53 100644
--- a/utils/image.go
+++ b/utils/image.go
@@ -72,7 +72,7 @@ func ExtractOCIImage(img v1.Image, targetDestination string) error {
 // GetImage if returns the proper image to pull with transport and auth
 // tries local daemon first and then fallbacks into remote
 // if auth is nil, it will try to use the default keychain https://github.com/google/go-containerregistry/tree/main/pkg/authn#tldr-for-consumers-of-this-package
-func GetImage(targetImage, targetPlatform string, auth *registrytypes.AuthConfig) (v1.Image, error) {
+func GetImage(targetImage, targetPlatform string, auth *registrytypes.AuthConfig, t http.RoundTripper) (v1.Image, error) {
 	var platform *v1.Platform
 	var image v1.Image
 	var err error
@@ -94,7 +94,11 @@ func GetImage(targetImage, targetPlatform string, auth *registrytypes.AuthConfig
 		return image, err
 	}
 
-	tr := transport.NewRetry(http.DefaultTransport,
+	if t == nil {
+		t = http.DefaultTransport
+	}
+
+	tr := transport.NewRetry(t,
 		transport.WithRetryBackoff(defaultRetryBackoff),
 		transport.WithRetryPredicate(defaultRetryPredicate),
 	)
@@ -118,12 +122,12 @@ func GetImage(targetImage, targetPlatform string, auth *registrytypes.AuthConfig
 	return image, err
 }
 
-func GetOCIImageSize(targetImage, targetPlatform string, auth *registrytypes.AuthConfig) (int64, error) {
+func GetOCIImageSize(targetImage, targetPlatform string, auth *registrytypes.AuthConfig, t http.RoundTripper) (int64, error) {
 	var size int64
 	var img v1.Image
 	var err error
 
-	img, err = GetImage(targetImage, targetPlatform, auth)
+	img, err = GetImage(targetImage, targetPlatform, auth, t)
 	if err != nil {
 		return size, err
 	}