Buildkit does not use AWS web identity for auth, cannot push to ECR

I'm running moby/buildkit:v0.11.6-rootless in Kubernetes v1.25, using AWS IRSA for IAM. The pod that runs buildkit looks like so:

    Environment:
      BUILDKITD_FLAGS:                    --oci-worker-no-process-sandbox
      AWS_STS_REGIONAL_ENDPOINTS:         regional
      AWS_DEFAULT_REGION:                 us-east-1
      AWS_REGION:                         us-east-1
      AWS_ROLE_ARN:                       arn:aws:iam::00000000:role/the-role-im-trying-to-use
      AWS_WEB_IDENTITY_TOKEN_FILE:        /var/run/secrets/eks.amazonaws.com/serviceaccount/token
    Mounts:
      /var/run/secrets/eks.amazonaws.com/serviceaccount from aws-iam-token (ro)

and other tools such as Kaniko are able to successfully push to ECR. Buildkit fails consistently with a 401 Unathorized. I have tested this by replacing the container image and the args from Buildkit to Kaniko.

Documentation suggests that this should be supported, but it is not.

No source file or test is named. Start by reproducing the provided rootless Kubernetes setup with AWS IRSA and an ECR push, then trace BuildKit's authentication path and compare it with the documented support. Done means the supplied web-identity environment authenticates successfully and BuildKit can push to ECR.