diff --git a/plan/task/gitPull.go b/plan/task/gitPull.go
index 6922f1f9..5cf1f2ad 100644
--- a/plan/task/gitPull.go
+++ b/plan/task/gitPull.go
@@ -24,7 +24,9 @@ func (c gitPullTask) Run(ctx context.Context, pctx *plancontext.Context, s solve
 		Remote     string
 		Ref        string
 		KeepGitDir bool
-		Username   string
+		Auth       struct {
+			Username string
+		}
 	}
 
 	if err := v.Decode(&gitPull); err != nil {
@@ -40,8 +42,8 @@ func (c gitPullTask) Run(ctx context.Context, pctx *plancontext.Context, s solve
 		gitOpts = append(gitOpts, llb.KeepGitDir())
 	}
 
-	if gitPull.Username != "" {
-		pwd := v.Lookup("password")
+	if gitPull.Auth.Username != "" {
+		pwd := v.Lookup("auth.password")
 
 		pwdSecret, err := pctx.Secrets.FromValue(pwd)
 		if err != nil {
@@ -53,16 +55,16 @@ func (c gitPullTask) Run(ctx context.Context, pctx *plancontext.Context, s solve
 			return nil, err
 		}
 
-		remote.User = url.UserPassword(gitPull.Username, strings.TrimSpace(pwdSecret.PlainText()))
+		remote.User = url.UserPassword(gitPull.Auth.Username, strings.TrimSpace(pwdSecret.PlainText()))
 		gitPull.Remote = remote.String()
-	} else if authToken := v.Lookup("authToken"); plancontext.IsSecretValue(authToken) {
+	} else if authToken := v.Lookup("auth.authToken"); plancontext.IsSecretValue(authToken) {
 		authTokenSecret, err := pctx.Secrets.FromValue(authToken)
 		if err != nil {
 			return nil, err
 		}
 		lg.Debug().Str("authToken", "***").Msg("adding git option")
 		gitOpts = append(gitOpts, llb.AuthTokenSecret(authTokenSecret.ID()))
-	} else if authHeader := v.Lookup("authHeader"); plancontext.IsSecretValue(authHeader) {
+	} else if authHeader := v.Lookup("auth.authHeader"); plancontext.IsSecretValue(authHeader) {
 		authHeaderSecret, err := pctx.Secrets.FromValue(authHeader)
 		if err != nil {
 			return nil, err
diff --git a/stdlib/europa/dagger/engine/git.cue b/stdlib/europa/dagger/engine/git.cue
index 83e3fa8c..aaa8fd17 100644
--- a/stdlib/europa/dagger/engine/git.cue
+++ b/stdlib/europa/dagger/engine/git.cue
@@ -19,7 +19,7 @@ package engine
 	remote:     string
 	ref:        string
 	keepGitDir: true | *false
-	{
+	auth?:      {
 		username: string
 		password: #Secret // can be password or personal access token
 	} | {
diff --git a/tests/tasks/gitPull/gitdir.cue b/tests/tasks/gitPull/gitdir.cue
index 93861b02..3baef549 100644
--- a/tests/tasks/gitPull/gitdir.cue
+++ b/tests/tasks/gitPull/gitdir.cue
@@ -16,7 +16,7 @@ engine.#Plan & {
 		}
 
 		image: engine.#Pull & {
-			source: "alpine:3.15.0@sha256:e7d88de73db3d3fd9b2d63aa7f447a10fd0220b7cbf39803c803f2af9ba256b3"
+			source: "alpine:3.15.0"
 		}
 
 		verify: engine.#Exec & {
@@ -27,8 +27,8 @@ engine.#Plan & {
 				[ -d /repo2/.git ]
 				"""]
 			mounts: {
-				repo_1: {dest: "/repo1", contents: repo1.output}
-				repo_2: {dest: "/repo2", contents: repo2.output}
+				a: {dest: "/repo1", contents: repo1.output}
+				b: {dest: "/repo2", contents: repo2.output}
 			}
 		}
 
diff --git a/tests/tasks/gitPull/privateRepo.cue b/tests/tasks/gitPull/privateRepo.cue
index 2aa2be53..84c5ee4b 100644
--- a/tests/tasks/gitPull/privateRepo.cue
+++ b/tests/tasks/gitPull/privateRepo.cue
@@ -14,10 +14,12 @@ engine.#Plan & {
 		}
 
 		testRepo: engine.#GitPull & {
-			remote:   "https://github.com/dagger/dagger.git"
-			ref:      "main"
-			username: "dagger-test"
-			password: inputs.secrets.token.contents
+			remote: "https://github.com/dagger/dagger.git"
+			ref:    "main"
+			auth: {
+				username: "dagger-test"
+				password: inputs.secrets.token.contents
+			}
 		}
 
 		testContent: engine.#Exec & {