diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b806588..59832b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,6 +89,19 @@ jobs:
           git lfs install --local
           git lfs pull
 
+      # Isaac Sim 6.0.1 on nvcr.io requires authenticated pull; anonymous
+      # access that worked for 6.0.0-dev2 is denied for this tag.
+      - name: Log in to NGC
+        env:
+          NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
+        run: |
+          if [ -z "${NGC_API_KEY}" ]; then
+            echo "NGC_API_KEY secret is empty; cannot pull nvcr.io/nvidia/isaac-sim"
+            exit 1
+          fi
+          # $oauthtoken is the literal NGC username.
+          echo "${NGC_API_KEY}" | docker login nvcr.io -u '$oauthtoken' --password-stdin
+
       - name: Run E2E tests
         run: ./scripts/ci/run_tests.sh
 
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 9d4b4d2..f8d4750 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -61,6 +61,19 @@ jobs:
           git lfs install --local
           git lfs pull
 
+      # Isaac Sim 6.0.1 on nvcr.io requires authenticated pull; anonymous
+      # access that worked for 6.0.0-dev2 is denied for this tag.
+      - name: Log in to NGC
+        env:
+          NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
+        run: |
+          if [ -z "${NGC_API_KEY}" ]; then
+            echo "NGC_API_KEY secret is empty; cannot pull nvcr.io/nvidia/isaac-sim"
+            exit 1
+          fi
+          # $oauthtoken is the literal NGC username.
+          echo "${NGC_API_KEY}" | docker login nvcr.io -u '$oauthtoken' --password-stdin
+
       - name: Run full E2E suite
         run: ./scripts/ci/run_tests.sh