--- a/taskcluster/docs/attributes.rst
+++ b/taskcluster/docs/attributes.rst
@@ -198,8 +198,15 @@ During the build phase, we build and sig
 we generate l10n repacks and push to the candidates directory. During the push phase,
 we push to the releases directory. During the ship phase, we update bouncer, push to
 Google Play, version bump, mark as shipped in ship-it.
 
 Using the "snowman model", we depend on previous graphs if they're defined. So if we
 ask for a ``push`` (the head of the snowman) and point at the body and base, we only
 build the head. If we don't point at the body and base, we build the whole snowman
 (build, promote, push).
+
+artifact_prefix
+===============
+Most taskcluster artifacts are public, so we've hardcoded ``public/build`` in a
+lot of places. To support private artifacts, we've moved this to the
+``artifact_prefix`` attribute. It will default to ``public/build`` but will be
+overrideable per-task.

--- a/taskcluster/taskgraph/util/attributes.py
+++ b/taskcluster/taskgraph/util/attributes.py
@@ -24,17 +24,22 @@ RELEASE_PROJECTS = {
 
 RELEASE_PROMOTION_PROJECTS = {
     'jamun',
     'maple',
     'try',
 } | RELEASE_PROJECTS
 
 _OPTIONAL_ATTRIBUTES = (
-    'nightly', 'signed', 'l10n_chunk', 'shipping_product', 'shipping_phase'
+    'artifact_prefix',
+    'l10n_chunk',
+    'nightly',
+    'signed',
+    'shipping_phase',
+    'shipping_product',
 )
 
 
 def attrmatch(attributes, **kwargs):
     """Determine whether the given set of task attributes matches.  The
     conditions are given as keyword arguments, where each keyword names an
     attribute.  The keyword value can be a literal, a set, or a callable.  A
     literal must match the attribute exactly.  Given a set, the attribute value