Cached 401 In Buildkit Cache

We are encountering occasional issues in which a build fails with the below 401 Unauthorized when trying to start a Docker build pulling the image in the first FROM directive in the Dockerfile.

#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 632B done
#1 DONE 0.0s

#2 [internal] load .dockerignore
#2 transferring context: 165B done
#2 DONE 0.0s

#3 [internal] load metadata for eu.gcr.io/at-artefacts/platform-base-java-17:191
------
 > [internal] load metadata for eu.gcr.io/at-artefacts/platform-base-java-17:191:
------
ERROR: failed to solve: rpc error: code = Unknown desc = failed to solve with frontend dockerfile.v0: failed to create LLB definition: failed to copy: httpReadSeeker: failed open: unexpected status code https://eu.gcr.io/v2/at-artefacts/platform-base-java-17/blobs/sha256:652282eaaf2292dea2b2de83e487e8ee2e5ab476376f4b378446eb4d516ec062: 401 Unauthorized

This was using the following build command:

docker buildx bake --sbom=false --provenance=false --builder gocd-multiarch  --set '*.tags=eu.gcr.io/at-artefacts/at-monkeynetes:latest' --set '*.tags=eu.gcr.io/at-artefacts/at-monkeynetes:59' --set '*.args.BUILDKIT_INLINE_CACHE=1' --set '*.cache-from=eu.gcr.io/at-artefacts/at-monkeynetes:latest,eu.gcr.io/at-artefacts/at-monkeynetes:build' --load app

Docker is configured to use gcloud cred helpers for eu.gcr.io. Subsequent builds of this same image, or others images which are also built FROM the same image (eu.gcr.io/at-artefacts/platform-base-java-17) failed with the same exact failure as above.
Other builds that built from different images, but still in the same eu.gcr.io/at-artefacts/ registry were building successfully.

The default builder configured is using the docker driver. The above build, when performed specifying a different builder instance (--builder), such as one using the docker-container driver, worked successfully.

It appears at some point the docker buildkit driver has cached a prior access token (which have at most 1 hour TTL when retrieved from the cred helper) for this particular build layer, which has prevented it being successfully pulled later on.

After performing a docker pull eu.gcr.io/at-artefacts/platform-base-java:latest (Same as tag :191), the above build command started working successfully.

Unfortunately haven't been able to build a reproducible example as of yet, and the issue only pops up on random builds.

Versions:
Buildx: 0.10.5
Buildkit: 0.11.6
Docker: 20.10.21
Platform: Linux

Start with the reported docker buildx bake command and compare the default docker driver with a docker-container builder, using the listed Buildx, BuildKit, and Docker versions. Investigate how credential-helper tokens are reused when pulling the first FROM layer from eu.gcr.io. Done means a reproducible case or regression test that prevents stale 401 responses while preserving cache behavior.