diff --git a/actions/push-to-gcs/README.md b/actions/push-to-gcs/README.md
index c837975d4..2cac23941 100644
--- a/actions/push-to-gcs/README.md
+++ b/actions/push-to-gcs/README.md
@@ -33,6 +33,14 @@ jobs:
           path: file.txt
           environment: "dev" # Can be dev/prod (defaults to dev)
 
+        # Upload a single file and apply a predefined ACL. See `predefinedAcl` for options.
+      - uses: grafana/shared-workflows/actions/push-to-gcs@main
+        with:
+          bucket: ${{ steps.login-to-gcs.outputs.bucket }}
+          path: file.txt
+          predefinedAcl: projectPrivate
+          environment: "dev"
+
         # Here are 3 equivalent statements to upload a single file and its parent directory to the bucket root
       - uses: grafana/shared-workflows/actions/push-to-gcs@main
         with:
@@ -98,17 +106,20 @@ jobs:
 
 ## Inputs
 
-| Name          | Type   | Description                                                                                                                                                                                  |
-| ------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `bucket`      | String | (Required) Name of bucket to upload to. Can be gathered from `login-to-gcs` action.                                                                                                          |
-| `path`        | String | (Required) The path to a file or folder inside the action's filesystem that should be uploaded to the bucket. You can specify either the absolute path or the relative path from the action. |
-| `bucket_path` | String | Bucket path where objects will be uploaded. Default is the bucket root.                                                                                                                      |
-| `environment` | String | Environment for pushing artifacts (can be either dev or prod).                                                                                                                               |
-| `glob`        | String | Glob pattern.                                                                                                                                                                                |
-| `parent`      | String | Whether parent dir should be included in GCS destination. Dirs included in the `glob` statement are unaffected by this setting.                                                              |
+| Name            | Type   | Description                                                                                                                                                                                  |
+| --------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `bucket`        | String | (Required) Name of bucket to upload to. Can be gathered from `login-to-gcs` action.                                                                                                          |
+| `path`          | String | (Required) The path to a file or folder inside the action's filesystem that should be uploaded to the bucket. You can specify either the absolute path or the relative path from the action. |
+| `bucket_path`   | String | Bucket path where objects will be uploaded. Default is the bucket root.                                                                                                                      |
+| `environment`   | String | Environment for pushing artifacts (can be either dev or prod).                                                                                                                               |
+| `glob`          | String | Glob pattern.                                                                                                                                                                                |
+| `parent`        | String | Whether parent dir should be included in GCS destination. Dirs included in the `glob` statement are unaffected by this setting.                                                              |
+| `predefinedAcl` | String | Predefined ACL applied to the uploaded objects. Default is `projectPrivate`. See [Google Documentation][gcs-docs-upload-options] for a list of available options.                            |
 
 ## Outputs
 
 | Name       | Type   | Description                                        |
 | ---------- | ------ | -------------------------------------------------- |
 | `uploaded` | String | The list of files that were successfully uploaded. |
+
+[gcs-docs-upload-options]: https://googleapis.dev/nodejs/storage/latest/global.html#UploadOptions
diff --git a/actions/push-to-gcs/action.yaml b/actions/push-to-gcs/action.yaml
index 0de7faa02..271eef8d0 100644
--- a/actions/push-to-gcs/action.yaml
+++ b/actions/push-to-gcs/action.yaml
@@ -27,6 +27,11 @@ inputs:
       Whether parent dir should be included in GCS destination.
       Dirs included in the `glob` statement are unaffected by this setting.
     default: "true"
+  predefinedAcl:
+    description: |
+      Apply a predefined set of access controls to the file(s).
+      Default is projectPrivate (See https://googleapis.dev/nodejs/storage/latest/global.html#UploadOptions)
+    default: projectPrivate
 
 outputs:
   uploaded:
@@ -82,4 +87,5 @@ runs:
         glob: ${{ inputs.glob }}
         destination: ${{ steps.construct-path.outputs.destination }} # bucket name plus folder prefix (if applicable)
         parent: ${{ inputs.parent }}
+        predefinedAcl: ${{ inputs.predefinedAcl }}
         process_gcloudignore: false