diff --git a/spring-cloud-consul-config/src/main/java/org/springframework/cloud/consul/config/ConfigWatch.java b/spring-cloud-consul-config/src/main/java/org/springframework/cloud/consul/config/ConfigWatch.java
index 3cf0b794..8ba9ba13 100644
--- a/spring-cloud-consul-config/src/main/java/org/springframework/cloud/consul/config/ConfigWatch.java
+++ b/spring-cloud-consul-config/src/main/java/org/springframework/cloud/consul/config/ConfigWatch.java
@@ -31,6 +31,7 @@ import org.springframework.cloud.endpoint.event.RefreshEvent;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.context.ApplicationEventPublisherAware;
 import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.util.StringUtils;
 
 import lombok.Data;
 import lombok.extern.apachecommons.CommonsLog;
@@ -80,7 +81,13 @@ public class ConfigWatch implements Closeable, ApplicationEventPublisherAware {
 						currentIndex = -1L;
 					}
 
-					Response<List<GetValue>> response = this.consul.getKVValues(context, new QueryParams(2, currentIndex));
+					// use the consul ACL token if found
+					String aclToken = properties.getAclToken();
+					if (StringUtils.isEmpty(aclToken)) {
+					    aclToken = null;
+					}
+
+					Response<List<GetValue>> response = this.consul.getKVValues(context, aclToken, new QueryParams(2, currentIndex));
 
 					// if response.value == null, response was a 404, otherwise it was a 200
 					// reducing churn if there wasn't anything
diff --git a/spring-cloud-consul-config/src/test/java/org/springframework/cloud/consul/config/ConfigWatchTests.java b/spring-cloud-consul-config/src/test/java/org/springframework/cloud/consul/config/ConfigWatchTests.java
index 37d2f0b2..8183a1da 100644
--- a/spring-cloud-consul-config/src/test/java/org/springframework/cloud/consul/config/ConfigWatchTests.java
+++ b/spring-cloud-consul-config/src/test/java/org/springframework/cloud/consul/config/ConfigWatchTests.java
@@ -23,11 +23,13 @@ import com.ecwid.consul.v1.kv.model.GetValue;
 import org.junit.Test;
 import org.springframework.cloud.endpoint.event.RefreshEvent;
 import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.util.StringUtils;
 
 import java.util.Arrays;
 import java.util.List;
 
 import static org.mockito.Matchers.any;
+import static org.mockito.Matchers.anyString;
 import static org.mockito.Matchers.eq;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
@@ -40,6 +42,15 @@ import static org.mockito.Mockito.when;
  */
 public class ConfigWatchTests {
 
+	@Test
+	public void watchPublishesEventWithAcl() {
+		ApplicationEventPublisher eventPublisher = mock(ApplicationEventPublisher.class);
+
+		setupWatch(eventPublisher, new GetValue(), "2ee647bd-bd69-4118-9f34-b9a6e9e60746");
+
+		verify(eventPublisher, times(1)).publishEvent(any(RefreshEvent.class));
+	}
+
 	@Test
 	public void watchPublishesEvent() {
 		ApplicationEventPublisher eventPublisher = mock(ApplicationEventPublisher.class);
@@ -59,6 +70,10 @@ public class ConfigWatchTests {
 	}
 
 	private void setupWatch(ApplicationEventPublisher eventPublisher, GetValue getValue) {
+		setupWatch(eventPublisher, getValue, null);
+	}
+
+	private void setupWatch(ApplicationEventPublisher eventPublisher, GetValue getValue, String aclToken) {
 		ConsulClient consul = mock(ConsulClient.class);
 		List<GetValue> getValues = null;
 
@@ -67,9 +82,13 @@ public class ConfigWatchTests {
 		}
 
 		Response<List<GetValue>> response = new Response<>(getValues, 1L, false, 1L);
-		when(consul.getKVValues(eq("/app/"), any(QueryParams.class))).thenReturn(response);
+		when(consul.getKVValues(eq("/app/"), anyString(), any(QueryParams.class))).thenReturn(response);
 
-		ConfigWatch watch = new ConfigWatch(new ConsulConfigProperties(), Arrays.asList("/app/"), consul);
+		ConsulConfigProperties properties = new ConsulConfigProperties();
+		if (StringUtils.hasText(aclToken)) {
+			properties.setAclToken(aclToken);
+		}
+		ConfigWatch watch = new ConfigWatch(properties, Arrays.asList("/app/"), consul);
 		watch.setApplicationEventPublisher(eventPublisher);
 		watch.getConsulIndexes().put("/app/", 0L);
 		watch.start();