diff --git a/client/alloc_watcher.go b/client/alloc_watcher.go
index <HASH>..<HASH> 100644
--- a/client/alloc_watcher.go
+++ b/client/alloc_watcher.go
@@ -215,7 +215,7 @@ type remotePrevAlloc struct {
 	// tasks on the new alloc
 	tasks []*structs.Task
 
-	// config for the Client to get AllocDir and Region
+	// config for the Client to get AllocDir, Region, and Node.SecretID
 	config *config.Config
 
 	// migrate is true if data should be moved between nodes
@@ -276,6 +276,7 @@ func (p *remotePrevAlloc) Wait(ctx context.Context) error {
 		QueryOptions: structs.QueryOptions{
 			Region:     p.config.Region,
 			AllowStale: true,
+			AuthToken:  p.config.Node.SecretID,
 		},
 	}
 
@@ -375,6 +376,7 @@ func (p *remotePrevAlloc) getNodeAddr(ctx context.Context, nodeID string) (strin
 		QueryOptions: structs.QueryOptions{
 			Region:     p.config.Region,
 			AllowStale: true,
+			AuthToken:  p.config.Node.SecretID,
 		},
 	}
Alloc watcher must send Node.SecretID as AuthToken

An auth token is required if ACLs are enabled