diff --git a/provider/internal/cli_test.go b/provider/internal/cli_test.go
index 7076708..96200a5 100644
--- a/provider/internal/cli_test.go
+++ b/provider/internal/cli_test.go
@@ -18,6 +18,8 @@ import (
 	"io"
 	"testing"
 
+	"github.com/docker/cli/cli/config/types"
+	"github.com/regclient/regclient/config"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -37,3 +39,56 @@ func TestExec(t *testing.T) {
 	require.NoError(t, err)
 	assert.Contains(t, string(out), "github.com/docker/buildx")
 }
+
+func TestWrappedAuth(t *testing.T) {
+	ecr := "https://1234.dkr.ecr.us-west-2.amazonaws.com"
+	h := &host{
+		auths: map[string]types.AuthConfig{
+			ecr: {
+				Username:      "host-aws-user",
+				Password:      "host-aws-password",
+				ServerAddress: ecr,
+			},
+			"misc": {
+				Username:      "host-misc-user",
+				Password:      "host-misc-password",
+				ServerAddress: "misc",
+			},
+		},
+	}
+
+	registries := []Registry{
+		{
+			Address:  "1234.dkr.ecr.us-west-2.amazonaws.com",
+			Username: "resource-aws-user",
+			Password: "resource-aws-password",
+		},
+		{
+			Address:  "docker.io",
+			Username: "resource-dockerhub-user",
+			Password: "resource-dockerhub-password",
+		},
+	}
+
+	cli, err := wrap(h, registries...)
+	require.NoError(t, err)
+
+	require.Contains(t, cli.auths, ecr)
+	aws := cli.auths[ecr]
+	assert.Equal(t, "resource-aws-user", aws.Username)
+	assert.Equal(t, "resource-aws-password", aws.Password)
+	assert.Equal(t, "1234.dkr.ecr.us-west-2.amazonaws.com", aws.ServerAddress)
+
+	require.Contains(t, cli.auths, config.DockerRegistryAuth)
+	dockerhub := cli.auths[config.DockerRegistryAuth]
+	assert.Equal(t, "resource-dockerhub-user", dockerhub.Username)
+	assert.Equal(t, "resource-dockerhub-password", dockerhub.Password)
+	assert.Equal(t, config.DockerRegistryDNS, dockerhub.ServerAddress)
+
+	// Auths derived from the host should be untouched, e.g. no scheme added, etc.
+	require.Contains(t, cli.auths, "misc")
+	misc := cli.auths["misc"]
+	assert.Equal(t, "host-misc-user", misc.Username)
+	assert.Equal(t, "host-misc-password", misc.Password)
+	assert.Equal(t, "misc", misc.ServerAddress)
+}