diff --git a/pkg/downloader/chart_downloader.go b/pkg/downloader/chart_downloader.go
index eca4e3342..712c80ad2 100644
--- a/pkg/downloader/chart_downloader.go
+++ b/pkg/downloader/chart_downloader.go
@@ -290,7 +290,7 @@ func (c *ChartDownloader) DownloadToCache(ref, version string) (string, *provena
 				return pth, ver, err
 			}
 
-			body, err := g.Get(u.String() + ".prov")
+			body, err := g.Get(u.String()+".prov", c.Options...)
 			if err != nil {
 				if c.Verify == VerifyAlways {
 					return pth, ver, fmt.Errorf("failed to fetch provenance %q", u.String()+".prov")
diff --git a/pkg/downloader/chart_downloader_test.go b/pkg/downloader/chart_downloader_test.go
index 92d4f024d..15e127b8c 100644
--- a/pkg/downloader/chart_downloader_test.go
+++ b/pkg/downloader/chart_downloader_test.go
@@ -18,6 +18,8 @@ package downloader
 import (
 	"crypto/sha256"
 	"encoding/hex"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
@@ -430,6 +432,55 @@ func TestDownloadToCache(t *testing.T) {
 	})
 }
 
+func TestDownloadToCachePassesOptionsToProvenance(t *testing.T) {
+	chartData, err := os.ReadFile("testdata/signtest-0.1.0.tgz")
+	require.NoError(t, err)
+	provData, err := os.ReadFile("testdata/signtest-0.1.0.tgz.prov")
+	require.NoError(t, err)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		username, password, ok := r.BasicAuth()
+		if !ok || username != "username" || password != "password" {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+
+		switch r.URL.Path {
+		case "/signtest-0.1.0.tgz":
+			_, _ = w.Write(chartData)
+		case "/signtest-0.1.0.tgz.prov":
+			_, _ = w.Write(provData)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	contentCache := t.TempDir()
+	c := ChartDownloader{
+		Out:              os.Stderr,
+		Verify:           VerifyLater,
+		RepositoryConfig: repoConfig,
+		RepositoryCache:  repoCache,
+		Getters: getter.All(&cli.EnvSettings{
+			RepositoryConfig: repoConfig,
+			RepositoryCache:  repoCache,
+			ContentCache:     contentCache,
+		}),
+		Options: []getter.Option{
+			getter.WithBasicAuth("username", "password"),
+		},
+		Cache: &DiskCache{Root: contentCache},
+	}
+
+	_, _, err = c.DownloadToCache(srv.URL+"/signtest-0.1.0.tgz", "")
+	require.NoError(t, err)
+
+	digest := sha256.Sum256(chartData)
+	_, err = c.Cache.Get(digest, CacheProv)
+	require.NoError(t, err, "provenance file should be in cache")
+}
+
 func TestStripDigestAlgorithm(t *testing.T) {
 	tests := map[string]struct {
 		input    string