diff --git a/garden-service/src/plugins/kubernetes/container/deployment.ts b/garden-service/src/plugins/kubernetes/container/deployment.ts
index 54a4bbd636..da5cfd1cf1 100644
--- a/garden-service/src/plugins/kubernetes/container/deployment.ts
+++ b/garden-service/src/plugins/kubernetes/container/deployment.ts
@@ -32,7 +32,7 @@ import { gardenAnnotationKey } from "../../../util/string"
 import { RuntimeContext } from "../../../runtime-context"
 import { resolve } from "path"
 import { killPortForwards } from "../port-forward"
-import { ensureSecret, prepareImagePullSecrets } from "../secrets"
+import { prepareImagePullSecrets } from "../secrets"
 
 export const DEFAULT_CPU_REQUEST = "10m"
 export const DEFAULT_MEMORY_REQUEST = "64Mi"
diff --git a/garden-service/src/plugins/kubernetes/run.ts b/garden-service/src/plugins/kubernetes/run.ts
index a8f0b1071f..aa8aea25cc 100644
--- a/garden-service/src/plugins/kubernetes/run.ts
+++ b/garden-service/src/plugins/kubernetes/run.ts
@@ -30,6 +30,7 @@ import { prepareEnvVars, makePodName } from "./util"
 import { deline } from "../../util/string"
 import { ArtifactSpec } from "../../config/validation"
 import cpy from "cpy"
+import { prepareImagePullSecrets } from "./secrets"
 
 export async function runAndCopy({
   ctx,
@@ -64,6 +65,7 @@ export async function runAndCopy({
   namespace: string
 }): Promise<RunResult> {
   const provider = <KubernetesProvider>ctx.provider
+  const api = await KubeApi.factory(log, provider)
 
   // Prepare environment variables
   envVars = { ...runtimeContext.envVars, ...envVars }
@@ -88,6 +90,7 @@ export async function runAndCopy({
         volumeMounts: [],
       },
     ],
+    imagePullSecrets: await prepareImagePullSecrets({ api, provider, namespace, log }),
   }
 
   if (!description) {
@@ -121,8 +124,6 @@ export async function runAndCopy({
     }
   }
 
-  const api = await KubeApi.factory(log, provider)
-
   if (!podName) {
     podName = makePodName("run", module.name)
   }
diff --git a/garden-service/test/integ/src/plugins/kubernetes/container/deployment.ts b/garden-service/test/integ/src/plugins/kubernetes/container/deployment.ts
index 8ad0c6e0d9..da85392e38 100644
--- a/garden-service/test/integ/src/plugins/kubernetes/container/deployment.ts
+++ b/garden-service/test/integ/src/plugins/kubernetes/container/deployment.ts
@@ -14,7 +14,6 @@ import { emptyRuntimeContext } from "../../../../../../src/runtime-context"
 import { KubeApi } from "../../../../../../src/plugins/kubernetes/api"
 import { createWorkloadManifest } from "../../../../../../src/plugins/kubernetes/container/deployment"
 import { KubernetesProvider } from "../../../../../../src/plugins/kubernetes/config"
-import { ensureSecret } from "../../../../../../src/plugins/kubernetes/secrets"
 import { V1Secret } from "@kubernetes/client-node"
 import { KubernetesResource } from "../../../../../../src/plugins/kubernetes/types"
 import { cloneDeep } from "lodash"