diff --git a/src/config.toml b/src/config.toml
index 18e8c2d..866a153 100644
--- a/src/config.toml
+++ b/src/config.toml
@@ -46,19 +46,24 @@ blackList = [
 # 无认证: socks5://127.0.0.1:1080
 # 有认证: socks5://username:password@127.0.0.1:1080
 # 留空不使用代理
-proxy = "" 
+proxy = ""
 
 [download]
 # 批量下载离线镜像数量限制
 maxImages = 10
 
+# Docker Hub 认证信息，留空则匿名拉取
+[dockerHubAuth]
+username = "" # e.g., user1
+token = "" # e.g., dckr_pat_***
+
 # Registry映射配置，支持多种镜像仓库上游
 [registries]
 
 # GitHub Container Registry
 [registries."ghcr.io"]
 upstream = "ghcr.io"
-authHost = "ghcr.io/token" 
+authHost = "ghcr.io/token"
 authType = "github"
 enabled = true
 
diff --git a/src/config/config.go b/src/config/config.go
index ceaf9de..bd98245 100644
--- a/src/config/config.go
+++ b/src/config/config.go
@@ -48,6 +48,11 @@ type AppConfig struct {
 		MaxImages int `toml:"maxImages"`
 	} `toml:"download"`
 
+	DockerHubAuth struct {
+		Username string `toml:"username"`
+		Token    string `toml:"token"`
+	} `toml:"dockerHubAuth"`
+
 	Registries map[string]RegistryMapping `toml:"registries"`
 
 	TokenCache struct {
@@ -108,6 +113,13 @@ func DefaultConfig() *AppConfig {
 		}{
 			MaxImages: 10,
 		},
+		DockerHubAuth: struct {
+			Username string `toml:"username"`
+			Token    string `toml:"token"`
+		}{
+			Username: "",
+			Token:    "",
+		},
 		Registries: map[string]RegistryMapping{
 			"ghcr.io": {
 				Upstream: "ghcr.io",
diff --git a/src/handlers/docker.go b/src/handlers/docker.go
index 63a740b..4b35bbc 100644
--- a/src/handlers/docker.go
+++ b/src/handlers/docker.go
@@ -68,10 +68,18 @@ func InitDockerProxy() {
 	}
 
 	options := []remote.Option{
-		remote.WithAuth(authn.Anonymous),
 		remote.WithUserAgent("hubproxy/go-containerregistry"),
 		remote.WithTransport(utils.GetGlobalHTTPClient().Transport),
 	}
+	dockerHubAuth := config.GetConfig().DockerHubAuth
+	if dockerHubAuth.Token != "" && dockerHubAuth.Username != "" {
+		options = append(options, remote.WithAuth(&authn.Basic{
+			Username: dockerHubAuth.Username,
+			Password: dockerHubAuth.Token,
+		}))
+	} else {
+		options = append(options, remote.WithAuth(authn.Anonymous))
+	}
 
 	dockerProxy = &DockerProxy{
 		registry: registry,