diff --git a/client/llb/exec.go b/client/llb/exec.go
index 82083066f..f4fc94bb1 100644
--- a/client/llb/exec.go
+++ b/client/llb/exec.go
@@ -199,6 +199,14 @@ func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata,
 		}
 	}
 
+	if len(e.secrets) > 0 {
+		addCap(&e.constraints, pb.CapMountSecret)
+	}
+
+	if len(e.ssh) > 0 {
+		addCap(&e.constraints, pb.CapMountSSH)
+	}
+
 	pop, md := MarshalConstraints(c, &e.constraints)
 	pop.Op = &pb.Op_Exec{
 		Exec: peo,
@@ -266,14 +274,6 @@ func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata,
 		peo.Mounts = append(peo.Mounts, pm)
 	}
 
-	if len(e.secrets) > 0 {
-		addCap(&e.constraints, pb.CapMountSecret)
-	}
-
-	if len(e.ssh) > 0 {
-		addCap(&e.constraints, pb.CapMountSSH)
-	}
-
 	for _, s := range e.secrets {
 		pm := &pb.Mount{
 			Dest:      s.Target,