diff --git a/build/pin-images.py b/build/pin-images.py
index 361db9c..644d0a2 100755
--- a/build/pin-images.py
+++ b/build/pin-images.py
@@ -49,10 +49,24 @@
     if image_ref.domain() in (
         "registry.k8s.io",
         "us-docker.pkg.dev",
-        "registry.atmosphere.dev",
     ):
         digest = get_digest(image_ref)
 
+    if image_ref.domain() == "registry.atmosphere.dev":
+        # Get token for docker.io
+        r = requests.get(
+            "https://registry.atmosphere.dev/service/token",
+            timeout=5,
+            params={
+                "service": "harbor-registry",
+                "scope": f"repository:{image_ref.path()}:pull",
+            },
+        )
+        r.raise_for_status()
+        token = r.json()["token"]
+
+        digest = get_digest(image_ref, token=token)
+
     if image_ref.domain() == "quay.io":
         r = requests.get(
             f"https://quay.io/api/v1/repository/{image_ref.path()}/tag/",
@@ -122,12 +136,6 @@
 
     args = parser.parse_args()
 
-    registry = args.registry
-    if "registry.atmosphere.dev:5000" in registry:
-        registry = registry.replace(
-            "registry.atmosphere.dev:5000", "registry.atmosphere.dev"
-        )
-
     yaml = YAML(typ="rt")
     data = yaml.load(args.src)
 
@@ -137,13 +145,13 @@
 
         # NOTE(mnaser): If we're in CI, only pin the Atmosphere images
         if (
-            "registry.atmosphere.dev" in registry
+            "registry.atmosphere.dev" in args.registry
             and "ghcr.io/vexxhost/atmosphere" not in data["_atmosphere_images"][image]
         ):
             continue
 
         image_src = data["_atmosphere_images"][image].replace(
-            "ghcr.io/vexxhost/atmosphere", registry
+            "ghcr.io/vexxhost/atmosphere", args.registry
         )
         pinned_image = get_pinned_image(image_src)