diff --git a/go.mod b/go.mod
index 0347e1ab3..12972ba42 100644
--- a/go.mod
+++ b/go.mod
@@ -30,7 +30,7 @@ require (
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/in-toto/in-toto-golang v0.10.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/moby/buildkit v0.29.0
+	github.com/moby/buildkit v0.29.1-0.20260408185135-a243ce438aee
 	github.com/moby/go-archive v0.2.0
 	github.com/moby/moby/api v1.54.1
 	github.com/moby/moby/client v0.4.0
diff --git a/go.sum b/go.sum
index a66b821d6..832e63255 100644
--- a/go.sum
+++ b/go.sum
@@ -420,8 +420,8 @@ github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/buildkit v0.29.0 h1:wxLEFbCOJntEDjSNNN2YWd8zxltZxT5muDQ0LzpbtpU=
-github.com/moby/buildkit v0.29.0/go.mod h1:Dmv2FeDe34t75QuzeU87rBoZpAAkcpT5zeu4hXzmASc=
+github.com/moby/buildkit v0.29.1-0.20260408185135-a243ce438aee h1:hA4wfynYJPaSnE4r1Ak5t/9goiG+OBKdQT29ZNxONrc=
+github.com/moby/buildkit v0.29.1-0.20260408185135-a243ce438aee/go.mod h1:afndr4EIChUihZio6mhkfTePNtO6KOJh4qW7zOXHhW0=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
diff --git a/vendor/github.com/moby/buildkit/session/auth/auth.go b/vendor/github.com/moby/buildkit/session/auth/auth.go
index 232022ad2..a99c4904c 100644
--- a/vendor/github.com/moby/buildkit/session/auth/auth.go
+++ b/vendor/github.com/moby/buildkit/session/auth/auth.go
@@ -25,10 +25,10 @@ func getSalt() []byte {
 	return salt
 }
 
-func CredentialsFunc(sm *session.Manager, g session.Group) func(string) (session, username, secret string, err error) {
+func CredentialsFunc(ctx context.Context, sm *session.Manager, g session.Group) func(string) (session, username, secret string, err error) {
 	return func(host string) (string, string, string, error) {
 		var sessionID, user, secret string
-		err := sm.Any(context.TODO(), g, func(ctx context.Context, id string, c session.Caller) error {
+		err := sm.Any(ctx, g, func(ctx context.Context, id string, c session.Caller) error {
 			client := NewAuthClient(c.Conn())
 
 			resp, err := client.Credentials(ctx, &CredentialsRequest{
diff --git a/vendor/github.com/moby/buildkit/util/gitutil/git_cli.go b/vendor/github.com/moby/buildkit/util/gitutil/git_cli.go
index 966e18ac4..ebfe5fd7b 100644
--- a/vendor/github.com/moby/buildkit/util/gitutil/git_cli.go
+++ b/vendor/github.com/moby/buildkit/util/gitutil/git_cli.go
@@ -27,6 +27,7 @@ type GitCLI struct {
 
 	sshAuthSock   string
 	sshKnownHosts string
+	hostGitConfig bool
 }
 
 // Option provides a variadic option for configuring the git client.
@@ -97,6 +98,15 @@ func WithSSHKnownHosts(sshKnownHosts string) Option {
 	}
 }
 
+// WithHostGitConfig allows git to read the host system and user git config.
+// This is intended for client-side local git inspection. The default remains
+// isolated so daemon-side callers do not leak host configuration into git.
+func WithHostGitConfig() Option {
+	return func(b *GitCLI) {
+		b.hostGitConfig = true
+	}
+}
+
 type StreamFunc func(context.Context) (io.WriteCloser, io.WriteCloser, func())
 
 // WithStreams configures a callback for getting the streams for a command. The
@@ -108,7 +118,7 @@ func WithStreams(streams StreamFunc) Option {
 	}
 }
 
-// New initializes a new git client
+// NewGitCLI initializes a new git client
 func NewGitCLI(opts ...Option) *GitCLI {
 	c := &GitCLI{}
 	for _, opt := range opts {
@@ -191,9 +201,28 @@ func (cli *GitCLI) Run(ctx context.Context, args ...string) (_ []byte, err error
 			"GIT_TERMINAL_PROMPT=0",
 			"GIT_SSH_COMMAND=" + getGitSSHCommand(cli.sshKnownHosts),
 			//	"GIT_TRACE=1",
-			"GIT_CONFIG_NOSYSTEM=1", // Disable reading from system gitconfig.
-			"HOME=/dev/null",        // Disable reading from user gitconfig.
-			"LC_ALL=C",              // Ensure consistent output.
+			"LC_ALL=C", // Ensure consistent output.
+		}
+		if cli.hostGitConfig {
+			for _, ev := range [...]string{
+				"HOME",
+				"XDG_CONFIG_HOME",
+				"USERPROFILE",
+				"HOMEDRIVE",
+				"HOMEPATH",
+				"GIT_CONFIG_GLOBAL",
+				"GIT_CONFIG_SYSTEM",
+			} {
+				if v, ok := os.LookupEnv(ev); ok {
+					cmd.Env = append(cmd.Env, ev+"="+v)
+				}
+			}
+		} else {
+			cmd.Env = append(cmd.Env,
+				"GIT_CONFIG_NOSYSTEM=1",         // Disable reading from system gitconfig.
+				"HOME="+os.DevNull,              // Disable reading from user gitconfig.
+				"GIT_CONFIG_GLOBAL="+os.DevNull, // Disable reading from global gitconfig.
+			)
 		}
 		for _, ev := range proxyEnvVars {
 			if v, ok := os.LookupEnv(ev); ok {
@@ -244,7 +273,7 @@ func (cli *GitCLI) Run(ctx context.Context, args ...string) (_ []byte, err error
 }
 
 func getGitSSHCommand(knownHosts string) string {
-	gitSSHCommand := "ssh -F /dev/null"
+	gitSSHCommand := "ssh -F " + os.DevNull
 	if knownHosts != "" {
 		gitSSHCommand += " -o UserKnownHostsFile=" + knownHosts
 	} else {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 3607c7a4e..5d5b5cc87 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -646,7 +646,7 @@ github.com/mitchellh/go-wordwrap
 # github.com/mitchellh/hashstructure/v2 v2.0.2
 ## explicit; go 1.14
 github.com/mitchellh/hashstructure/v2
-# github.com/moby/buildkit v0.29.0
+# github.com/moby/buildkit v0.29.1-0.20260408185135-a243ce438aee
 ## explicit; go 1.25.5
 github.com/moby/buildkit/api/services/control
 github.com/moby/buildkit/api/types