diff --git a/env-example b/env-example
index 7b3e4a3..aa61fb4 100644
--- a/env-example
+++ b/env-example
@@ -1,5 +1,6 @@
 ATHENA_DB=
 ATHENA_TABLE=
+BQ_CLIENT_CONFIG=
 BQ_DATASET=
 DT_LOG_EXPIRATION_DAYS=
 MAX_DAYS_TO_ROLLUP=
diff --git a/lib/bigquery.js b/lib/bigquery.js
index 8c01f5f..e6fadaa 100644
--- a/lib/bigquery.js
+++ b/lib/bigquery.js
@@ -6,9 +6,21 @@ const { BigQuery } = require("@google-cloud/bigquery");
 
 const gzip = promisify(zlib.gzip);
 
+// optional: google workload identity federation
+exports.opts = () => {
+  if (process.env.BQ_CLIENT_CONFIG) {
+    const config = JSON.parse(process.env.BQ_CLIENT_CONFIG);
+    return {
+      projectId: config.audience.match(/projects\/([0-9]+)\/locations/)[1],
+      credentials: config,
+    };
+  }
+  return {};
+};
+
 // mockable dataset
 exports.dataset = () => {
-  const bq = new BigQuery();
+  const bq = new BigQuery(exports.opts());
   return bq.dataset(process.env.BQ_DATASET);
 };