diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2197287..488df79 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ and **Merged pull requests**. Critical items to know are:
 The versions coincide with releases on pip. Only major versions will be released as tags on Github.
 
 ## [0.0.x](https://github.com/oras-project/oras-py/tree/main) (0.0.x)
+ - Add Auth headers to request when using `BasicAuth` (0.2.39)
  - fix Python 3.7+ compatibility by avoiding union syntax and rely on typing (0.2.38)
  - Use the correct credsStore/credHelpers binary (0.2.37)
  - Properly prioritize auth methods (0.2.36)
diff --git a/oras/provider.py b/oras/provider.py
index cb0cfc9..df5d958 100644
--- a/oras/provider.py
+++ b/oras/provider.py
@@ -992,7 +992,13 @@ def do_request(
             headers = {}
 
         # Make the request and return to calling function, but attempt to use auth token if previously obtained
-        if isinstance(self.auth, oras.auth.TokenAuth) and self.auth.token is not None:
+        if (
+            isinstance(self.auth, oras.auth.TokenAuth) and self.auth.token is not None
+        ) or (
+            isinstance(self.auth, oras.auth.BasicAuth)
+            and hasattr(self.auth, "_basic_auth")
+            and self.auth._basic_auth is not None
+        ):
             headers.update(self.auth.get_auth_header())
         response = self.session.request(
             method,
diff --git a/oras/version.py b/oras/version.py
index a27bed0..1f56a2a 100644
--- a/oras/version.py
+++ b/oras/version.py
@@ -2,7 +2,7 @@
 __copyright__ = "Copyright The ORAS Authors."
 __license__ = "Apache-2.0"
 
-__version__ = "0.2.38"
+__version__ = "0.2.39"
 AUTHOR = "Vanessa Sochat"
 EMAIL = "vsoch@users.noreply.github.com"
 NAME = "oras"