CRW brings cumbersome workflow with Enterprise Container Registry

We have a user reporting an interesting problem. The user is operating in a restricted (air-gapped) environment and is using a secured Enterprise Container Registry to hold their images.

When a new workspace is made, the user gets an error saying that the desired image could not be pulled from the self-hosted secure registry.

It seems in a vanilla (not air-gapped) installation, there is a Service Account that has an image pull secret to allow access to the Red Hat registry. This is what allows images to be pulled (again, in a vanilla scenario.)

In this user's air-gapped environment, the new workspace (OpenShift Project) needs to be given the ECR pull secret, and this must be linked to the Service Account. In this way, images can be pulled from the user's secured registry via the same mechanisms that pull from our own RH registry in a vanilla installation.

If the above is done manually, everything is fine. But it's prohibitively tedious, of course.

See attached PDF for illustration.

So finally the question: Is there a way we can automate this?