--- a/taskcluster/taskgraph/transforms/use_toolchains.py
+++ b/taskcluster/taskgraph/transforms/use_toolchains.py
@@ -63,41 +63,51 @@ def use_toolchains(config, jobs):
                     % (job['name'], key, aliases[key])
                 )
             return key
     else:
         def get_alias(key):
             return aliases.get(key, key)
 
     for job in jobs:
+        scopes = job.setdefault('scopes', [])
         env = job.setdefault('worker', {}).setdefault('env', {})
 
         toolchains = [get_alias(t)
                       for t in job.pop('toolchains', [])]
 
         if config.kind == 'toolchain' and job['name'] in toolchains:
             raise Exception("Toolchain job %s can't use itself as toolchain"
                             % job['name'])
 
         filenames = {}
         for t in toolchains:
             if t not in artifacts:
                 raise Exception('Missing toolchain job for %s-%s: %s'
                                 % (config.kind, job['name'], t))
 
-            f = os.path.basename(artifacts[t])
+            dirname, f = os.path.split(artifacts[t])
             if f in filenames:
                 # Build jobs don't support toolchain artifacts with the same
                 # name: they would overwrite one with the other.
                 raise Exception('%s-%s cannot use both %s and %s toolchains: '
                                 'they both have the same artifact name %s'
                                 % (config.kind, job['name'], filenames[f],
                                    t, f))
             filenames[f] = t
 
+            if not artifacts[t].startswith('public/'):
+                # Use taskcluster-proxy and request appropriate scope.
+                # For example, add 'scopes: [queue:get-artifact:path/to/*]'
+                # for 'path/to/artifact.tar.xz'.
+                job['worker']['taskcluster-proxy'] = True
+                scope = 'queue:get-artifact:{}/*'.format(dirname)
+                if scope not in scopes:
+                    scopes.append(scope)
+
             if t.endswith('-sccache'):
                 job['needs-sccache'] = True
 
         if toolchains:
             job.setdefault('dependencies', {}).update(
                 ('toolchain-%s' % t, 'toolchain-%s' % t)
                 for t in toolchains
             )