diff --git a/stable/spinnaker/Chart.yaml b/stable/spinnaker/Chart.yaml
index 232bb9273b..49a97ca821 100644
--- a/stable/spinnaker/Chart.yaml
+++ b/stable/spinnaker/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence.
 name: spinnaker
-version: 1.23.0
+version: 1.23.1
 appVersion: 1.16.2
 home: http://spinnaker.io/
 sources:
diff --git a/stable/spinnaker/README.md b/stable/spinnaker/README.md
index 4bbced4eb9..e0fcdf1ca2 100644
--- a/stable/spinnaker/README.md
+++ b/stable/spinnaker/README.md
@@ -103,6 +103,10 @@ dockerRegistries:
 #   username: _json_key
 #   password: '<INSERT YOUR SERVICE ACCOUNT JSON HERE>'
 #   email: 1234@5678.com
+# - name: ecr
+#   address: https://<AWS-ACCOUNT-ID>.dkr.ecr.<REGION>.amazonaws.com
+#   username: AWS
+#   passwordCommand: "aws --region <REGION> ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken' | base64 -d | sed 's/^AWS://'"
 ```
 
 You can provide passwords as a Helm value, or you can use a pre-created secret containing your registry passwords.  The secret should have an item per Registry in the format: `<registry name>: <password>`. In which case you'll specify the secret to use in `dockerRegistryAccountSecret` like so:
diff --git a/stable/spinnaker/templates/configmap/halyard-config.yaml b/stable/spinnaker/templates/configmap/halyard-config.yaml
index 303dd54bfc..80d02c0830 100644
--- a/stable/spinnaker/templates/configmap/halyard-config.yaml
+++ b/stable/spinnaker/templates/configmap/halyard-config.yaml
@@ -101,7 +101,12 @@ data:
 
     CREDS=""
     {{ if $registry.username -}}
-    CREDS+="--username {{ $registry.username }} --password-file /opt/registry/passwords/{{ $registry.name }}"
+    CREDS+="--username {{ $registry.username }}"
+    {{ if $registry.passwordCommand -}}
+    CREDS+=" --password-command {{ $registry.passwordCommand | quote }}"
+    {{- else -}}
+    CREDS+=" --password-file /opt/registry/passwords/{{ $registry.name }}"
+    {{- end -}}
     {{ if $registry.email -}}
     CREDS+=" --email {{ $registry.email }}"
     {{- end -}}
diff --git a/stable/spinnaker/values.yaml b/stable/spinnaker/values.yaml
index ae2af51ca3..02814ef912 100644
--- a/stable/spinnaker/values.yaml
+++ b/stable/spinnaker/values.yaml
@@ -147,6 +147,10 @@ dockerRegistries:
 #   username: _json_key
 #   password: '<INSERT YOUR SERVICE ACCOUNT JSON HERE>'
 #   email: 1234@5678.com
+# - name: ecr
+#   address: <AWS-ACCOUNT-ID>.dkr.ecr.<REGION>.amazonaws.com
+#   username: AWS
+#   passwordCommand: "aws --region <REGION> ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken' | base64 -d | sed 's/^AWS://'"
 
 # If you don't want to put your passwords into a values file
 # you can use a pre-created secret instead of putting passwords