diff --git a/README.md b/README.md
index c00d4f0e..f87d5c59 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,9 @@ Install Litmus as a gem by running `gem install puppet_litmus`.
 
 - Note if you choose to override the `litmus_inventory.yaml` location, please ensure that the directory structure you define exists.
 
-## Install a specific puppet agent version
+## Agent installs
+
+### Install a specific puppet agent version
 
 To install a specific version of the puppet agent, you can export the `PUPPET_VERSION` env var, like below:
 ```
@@ -38,6 +40,13 @@ export PUPPET_VERSION=8.8.1
 
 When set, the `litmus:install_agent` rake task will install the specified version. The default is `latest`.
 
+## Installing puppetcore agents
+
+To install a puppetcore puppet agent through the `litmus:install_agent` rake task, you need to export your Forge API key as an env var, like below:
+```
+export PUPPET_FORGE_TOKEN='<your_forge_api_key>'
+```
+
 ## matrix_from_metadata_v3
 
 matrix_from_metadata_v3 tool generates a github action matrix from the supported operating systems listed in the module's metadata.json.
diff --git a/lib/puppet_litmus/rake_helper.rb b/lib/puppet_litmus/rake_helper.rb
index 330f311f..7a9fa5b6 100644
--- a/lib/puppet_litmus/rake_helper.rb
+++ b/lib/puppet_litmus/rake_helper.rb
@@ -4,7 +4,7 @@
 require 'puppet_litmus/version'
 
 # helper methods for the litmus rake tasks
-module PuppetLitmus::RakeHelper
+module PuppetLitmus::RakeHelper # rubocop:disable Metrics/ModuleLength
   # DEFAULT_CONFIG_DATA should be frozen for our safety, but it needs to work around https://github.com/puppetlabs/bolt/pull/1696
   DEFAULT_CONFIG_DATA = { 'modulepath' => File.join(Dir.pwd, 'spec', 'fixtures', 'modules') } # .freeze # rubocop:disable Style/MutableConstant
   SUPPORTED_PROVISIONERS = %w[abs docker docker_exp lxd provision_service vagrant vmpooler].freeze
@@ -130,13 +130,18 @@ def tear_down(node_name, inventory_hash)
   def install_agent(collection, targets, inventory_hash)
     include ::BoltSpec::Run
     puppet_version = ENV.fetch('PUPPET_VERSION', nil)
+    forge_token = ENV.fetch('PUPPET_FORGE_TOKEN', nil)
     params = {}
+    params['password'] = forge_token if forge_token
     params['collection'] = collection  if collection
     params['version'] = puppet_version if puppet_version
 
     raise "puppet_agent was not found in #{DEFAULT_CONFIG_DATA['modulepath']}, please amend the .fixtures.yml file" \
       unless File.directory?(File.join(DEFAULT_CONFIG_DATA['modulepath'], 'puppet_agent'))
 
+    raise 'puppetcore agent installs require a valid PUPPET_FORGE_TOKEN set in the env.' \
+        if collection =~ /\Apuppetcore.*/ && !forge_token
+
     # using boltspec, when the runner is called it changes the inventory_hash dropping the version field. The clone works around this
     bolt_result = run_task('puppet_agent::install', targets, params, config: DEFAULT_CONFIG_DATA, inventory: inventory_hash.clone)
     targets.each do |target|
diff --git a/spec/lib/puppet_litmus/rake_helper_spec.rb b/spec/lib/puppet_litmus/rake_helper_spec.rb
index eadf0194..8caa3af3 100644
--- a/spec/lib/puppet_litmus/rake_helper_spec.rb
+++ b/spec/lib/puppet_litmus/rake_helper_spec.rb
@@ -131,13 +131,34 @@
           [{ 'uri' => 'some.host', 'facts' => { 'provisioner' => 'docker', 'container_name' => 'foo', 'platform' => 'some.host' } }] }] }
     end
     let(:targets) { ['some.host'] }
-    let(:params) { { 'collection' => 'puppet6' } }
+    let(:token) { 'some_token' }
+    let(:params) { { 'collection' => 'puppet6', 'password' => token } }
 
     it 'calls function' do
+      allow(ENV).to receive(:fetch).with('PUPPET_VERSION', nil).and_return(nil)
+      allow(ENV).to receive(:fetch).with('PUPPET_FORGE_TOKEN', nil).and_return(token)
       allow(File).to receive(:directory?).with(File.join(described_class::DEFAULT_CONFIG_DATA['modulepath'], 'puppet_agent')).and_return(true)
       allow_any_instance_of(BoltSpec::Run).to receive(:run_task).with('puppet_agent::install', targets, params, config: described_class::DEFAULT_CONFIG_DATA, inventory: inventory_hash).and_return([])
       install_agent('puppet6', targets, inventory_hash)
     end
+
+    it 'adds puppet version' do
+      params = { 'collection' => 'puppet7', 'version' => '7.35.0' }
+      allow(ENV).to receive(:fetch).with('PUPPET_VERSION', nil).and_return('7.35.0')
+      allow(ENV).to receive(:fetch).with('PUPPET_FORGE_TOKEN', nil).and_return(nil)
+      allow(File).to receive(:directory?).with(File.join(described_class::DEFAULT_CONFIG_DATA['modulepath'], 'puppet_agent')).and_return(true)
+      allow_any_instance_of(BoltSpec::Run).to receive(:run_task).with('puppet_agent::install', targets, params, config: described_class::DEFAULT_CONFIG_DATA, inventory: inventory_hash).and_return([])
+      install_agent('puppet7', targets, inventory_hash)
+    end
+
+    it 'fails for puppetcore if no token supplied' do
+      params = { 'collection' => 'puppetcore7' }
+      allow(ENV).to receive(:fetch).with('PUPPET_VERSION', nil).and_return(nil)
+      allow(ENV).to receive(:fetch).with('PUPPET_FORGE_TOKEN', nil).and_return(nil)
+      allow(File).to receive(:directory?).with(File.join(described_class::DEFAULT_CONFIG_DATA['modulepath'], 'puppet_agent')).and_return(true)
+      allow_any_instance_of(BoltSpec::Run).to receive(:run_task).with('puppet_agent::install', targets, params, config: described_class::DEFAULT_CONFIG_DATA, inventory: inventory_hash).and_return([])
+      expect { install_agent('puppetcore7', targets, inventory_hash) }.to raise_error(RuntimeError, /puppetcore agent installs require a valid PUPPET_FORGE_TOKEN set in the env\./)
+    end
   end
 
   context 'with install_module' do