Just to close out this thread. After ensuring that his GitLab group was added as an organization in Pulumi, and be a member of it as well, he also needed to change the backing identity of the org in Pulumi to be GitLab-based. You can do that on the Settings > Access Management page of the respective organization in Pulumi.