diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml
index 55fa2dff9..3b6d229f5 100644
--- a/.github/workflows/.test.yml
+++ b/.github/workflows/.test.yml
@@ -94,7 +94,7 @@ jobs:
           targets: integration-tests-base
           set: |
             *.cache-from=type=gha,scope=${{ inputs.cache_scope }}
-            *.cache-to=type=gha,scope=${{ inputs.cache_scope }}
+            *.cache-to=type=gha,scope=${{ inputs.cache_scope }},repository=${{ github.repository }},ghtoken=${{ secrets.GITHUB_TOKEN }}
 
   run:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml
index 7fd5846f6..c21e2e25c 100644
--- a/.github/workflows/buildkit.yml
+++ b/.github/workflows/buildkit.yml
@@ -106,6 +106,7 @@ jobs:
           PLATFORMS: ${{ matrix.platform }}
           CACHE_FROM: type=gha,scope=binaries-${{ env.PLATFORM_PAIR }}
           CACHE_TO: type=gha,scope=binaries-${{ env.PLATFORM_PAIR }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Upload artifacts
         uses: actions/upload-artifact@v4
@@ -186,6 +187,7 @@ jobs:
           TARGET: ${{ matrix.target-stage }}
           CACHE_FROM: type=gha,scope=image${{ matrix.target-stage }}
           CACHE_TO: type=gha,scope=image${{ matrix.target-stage }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   release:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index ca25b98fc..b7668bbe6 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -123,6 +123,7 @@ jobs:
           RELEASE: ${{ startsWith(github.ref, 'refs/tags/v') }}
           CACHE_FROM: type=gha,scope=${{ env.CACHE_SCOPE }}
           CACHE_TO: type=gha,scope=${{ env.CACHE_SCOPE }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   release:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/test-os.yml b/.github/workflows/test-os.yml
index b87aef747..59afdd453 100644
--- a/.github/workflows/test-os.yml
+++ b/.github/workflows/test-os.yml
@@ -20,6 +20,8 @@ on:
 
 env:
   GO_VERSION: "1.22"
+  SETUP_BUILDX_VERSION: "latest"
+  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   DESTDIR: "./bin"
 
 jobs:
@@ -43,6 +45,10 @@ jobs:
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ env.SETUP_BUILDX_VERSION }}
+          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
+          buildkitd-flags: --debug
       -
         name: Build
         uses: docker/bake-action@v5
@@ -52,7 +58,7 @@ jobs:
           set: |
             *.platform=${{ matrix.platform }}
             *.cache-from=type=gha,scope=binaries-for-test-${{ env.PLATFORM_PAIR }}
-            *.cache-to=type=gha,scope=binaries-for-test-${{ env.PLATFORM_PAIR }}
+            *.cache-to=type=gha,scope=binaries-for-test-${{ env.PLATFORM_PAIR }},repository=${{ github.repository }},ghtoken=${{ secrets.GITHUB_TOKEN }}
       -
         name: List artifacts
         run: |
diff --git a/hack/images b/hack/images
index a323e77e1..a5f12bb53 100755
--- a/hack/images
+++ b/hack/images
@@ -85,7 +85,7 @@ exportCacheFlags=""
 if [ -n "$cacheToFlags" ]; then
   exportCacheFlags="$cacheToFlags"
 elif [ "$PUSH" = "push" ]; then
-  exportCacheFlags="$exportCacheFlags--cache-to=type=inline "
+  exportCacheFlags="--cache-to=type=inline"
 fi
 
 tagFlags=""
diff --git a/hack/release b/hack/release
index 20416b789..449971e33 100755
--- a/hack/release
+++ b/hack/release
@@ -5,6 +5,7 @@ set -eu -o pipefail
 : "${GITHUB_ACTIONS=}"
 : "${GITHUB_REPOSITORY=}"
 : "${GITHUB_RUN_ID=}"
+: "${GITHUB_TOKEN=}"
 
 : "${BUILDX_CMD=docker buildx}"
 : "${DESTDIR=./bin/release}"
@@ -15,11 +16,27 @@ set -eu -o pipefail
 
 if [ -n "$CACHE_FROM" ]; then
   for cfrom in $CACHE_FROM; do
+    if [[ $cfrom == *"type=gha"* ]]; then
+      if [[ -n "$GITHUB_REPOSITORY" ]] && [[ $cfrom != *"repository="* ]]; then
+        cfrom="${cfrom},repository=${GITHUB_REPOSITORY}"
+      fi
+      if [[ -n "$GITHUB_TOKEN" ]] && [[ $cfrom != *"ghtoken="* ]]; then
+        cfrom="${cfrom},ghtoken=${GITHUB_TOKEN}"
+      fi
+    fi
     setFlags+=(--set "*.cache-from=$cfrom")
   done
 fi
 if [ -n "$CACHE_TO" ]; then
   for cto in $CACHE_TO; do
+    if [[ $cto == *"type=gha"* ]]; then
+      if [[ -n "$GITHUB_REPOSITORY" ]] && [[ $cto != *"repository="* ]]; then
+        cto="${cto},repository=${GITHUB_REPOSITORY}"
+      fi
+      if [[ -n "$GITHUB_TOKEN" ]] && [[ $cto != *"ghtoken="* ]]; then
+        cto="${cto},ghtoken=${GITHUB_TOKEN}"
+      fi
+    fi
     setFlags+=(--set "*.cache-to=$cto")
   done
 fi
diff --git a/hack/util b/hack/util
index 14ccc624a..efd56b2d5 100755
--- a/hack/util
+++ b/hack/util
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 
 : "${BUILDX_CMD=docker buildx}"
 : "${BUILDX_BUILDER=}"
@@ -6,6 +6,7 @@
 : "${GITHUB_ACTIONS=}"
 : "${GITHUB_REPOSITORY=}"
 : "${GITHUB_RUN_ID=}"
+: "${GITHUB_TOKEN=}"
 
 : "${CONTEXT=}"
 : "${CACHE_FROM=}"
@@ -43,11 +44,27 @@ if [ "$GITHUB_ACTIONS" = "true" ] && [ "$GITHUB_REPOSITORY" = "moby/buildkit" ];
   currentref="https://github.com/$GITHUB_REPOSITORY.git#$GITHUB_REF"
   if [ -n "$CACHE_FROM" ]; then
     for cfrom in $CACHE_FROM; do
+      if [[ $cfrom == *"type=gha"* ]]; then
+        if [[ -n "$GITHUB_REPOSITORY" ]] && [[ $cfrom != *"repository="* ]]; then
+          cfrom="${cfrom},repository=${GITHUB_REPOSITORY}"
+        fi
+        if [[ -n "$GITHUB_TOKEN" ]] && [[ $cfrom != *"ghtoken="* ]]; then
+          cfrom="${cfrom},ghtoken=${GITHUB_TOKEN}"
+        fi
+      fi
       cacheFromFlags="${cacheFromFlags}--cache-from=$cfrom "
     done
   fi
   if [ -n "$CACHE_TO" ]; then
     for cto in $CACHE_TO; do
+      if [[ $cto == *"type=gha"* ]]; then
+        if [[ -n "$GITHUB_REPOSITORY" ]] && [[ $cto != *"repository="* ]]; then
+          cto="${cto},repository=${GITHUB_REPOSITORY}"
+        fi
+        if [[ -n "$GITHUB_TOKEN" ]] && [[ $cto != *"ghtoken="* ]]; then
+          cto="${cto},ghtoken=${GITHUB_TOKEN}"
+        fi
+      fi
       cacheToFlags="${cacheToFlags}--cache-to=$cto "
     done
   fi