diff --git a/app/models/group.rb b/app/models/group.rb
index 8ff781059cc01592a0c726031713b81bd7e5dc60..ec27f757f463bf71357144fc6c691a013b1cca19 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -9,6 +9,7 @@ class Group < Namespace
   include SelectForProjectAuthorization
   include LoadedInGroupList
   include GroupDescendant
+  include TokenAuthenticatable
 
   has_many :group_members, -> { where(requested_at: nil) }, dependent: :destroy, as: :source # rubocop:disable Cop/ActiveRecordDependent
   alias_method :members, :group_members
@@ -43,6 +44,9 @@ class Group < Namespace
 
   validates :two_factor_grace_period, presence: true, numericality: { greater_than_or_equal_to: 0 }
 
+  add_authentication_token_field :runners_token
+  before_save :ensure_runners_token
+
   after_create :post_create_hook
   after_destroy :post_destroy_hook
   after_save :update_two_factor_requirement
diff --git a/db/migrate/20170906133745_add_runners_token_to_groups.rb b/db/migrate/20170906133745_add_runners_token_to_groups.rb
new file mode 100644
index 0000000000000000000000000000000000000000..54d0fddd5e3a268cc4d149ea971db0eabad7524f
--- /dev/null
+++ b/db/migrate/20170906133745_add_runners_token_to_groups.rb
@@ -0,0 +1,17 @@
+class AddRunnersTokenToGroups < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_column :namespaces, :runners_token, :string
+
+    add_concurrent_index :namespaces, :runners_token, unique: true
+  end
+
+  def down
+    remove_column :namespaces, :runners_token
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 9f3b27b8b6ade0b85b1c09d3874c0efb3a6e54fd..b2c37a65ccfa3852d86e7a6639495519a6d647da 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1270,6 +1270,7 @@ ActiveRecord::Schema.define(version: 20180418053107) do
     t.boolean "require_two_factor_authentication", default: false, null: false
     t.integer "two_factor_grace_period", default: 48, null: false
     t.integer "cached_markdown_version"
+    t.string "runners_token"
   end
 
   add_index "namespaces", ["created_at"], name: "index_namespaces_on_created_at", using: :btree
@@ -1280,6 +1281,7 @@ ActiveRecord::Schema.define(version: 20180418053107) do
   add_index "namespaces", ["path"], name: "index_namespaces_on_path", using: :btree
   add_index "namespaces", ["path"], name: "index_namespaces_on_path_trigram", using: :gin, opclasses: {"path"=>"gin_trgm_ops"}
   add_index "namespaces", ["require_two_factor_authentication"], name: "index_namespaces_on_require_two_factor_authentication", using: :btree
+  add_index "namespaces", ["runners_token"], name: "index_namespaces_on_runners_token", unique: true, using: :btree
   add_index "namespaces", ["type"], name: "index_namespaces_on_type", using: :btree
 
   create_table "notes", force: :cascade do |t|