diff --git a/.drone.yml b/.drone.yml
index b96c32c6952..f5002025e18 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -4066,6 +4066,18 @@ get:
 kind: secret
 name: prerelease_bucket
 ---
+get:
+  name: username
+  path: infra/data/ci/grafanaci-docker-hub
+kind: secret
+name: docker_username
+---
+get:
+  name: password
+  path: infra/data/ci/grafanaci-docker-hub
+kind: secret
+name: docker_password
+---
 get:
   name: credentials.json
   path: infra/data/ci/grafana/releng/artifacts-uploader-service-account
@@ -4217,6 +4229,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 5cd4b7348cab90c07fbea0366401945102808db3cd38e31aac7eec2ce5c8ef66
+hmac: d964d9e55d85019528a6e1b9f3ddf606906e2320b11988bb0ed47773404d31d9
 
 ...
diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star
index 908299a66d0..378d7bedf90 100644
--- a/scripts/drone/vault.star
+++ b/scripts/drone/vault.star
@@ -41,6 +41,8 @@ def secrets():
         vault_secret("github_token", "infra/data/ci/github/grafanabot", "pat"),
         vault_secret(drone_token, "infra/data/ci/drone", "machine-user-token"),
         vault_secret(prerelease_bucket, "infra/data/ci/grafana/prerelease", "bucket"),
+        vault_secret("docker_username", "infra/data/ci/grafanaci-docker-hub", "username"),
+        vault_secret("docker_password", "infra/data/ci/grafanaci-docker-hub", "password"),
         vault_secret(
             gcp_upload_artifacts_key,
             "infra/data/ci/grafana/releng/artifacts-uploader-service-account",