diff --git a/infra-pipeline.yaml b/infra-pipeline.yaml
index 6476c4e7..ee427198 100644
--- a/infra-pipeline.yaml
+++ b/infra-pipeline.yaml
@@ -47,6 +47,15 @@ parameters:
         component: inventory
         destroy: false
         deploy: true
+        preStep:
+          - task: AzureCLI@2
+            displayName: Download GitHub Private Key
+            condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+            inputs:
+              azureSubscription: "MSDN Sub"
+              scriptType: "bash"
+              scriptLocation: "inlineScript"
+              inlineScript: az keyvault secret download --name GitHub-Bot-Private-Key --vault-name bancey-vault --file $(System.DefaultWorkingDirectory)/private-key.pem
         dependsOn: []
       - deployment: prod_twingate
         environment: prod