diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 517356642692..6afedac13ee8 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -164,6 +164,10 @@ CGO_ENABLED=1 GOBUILDFLAGS="-race" ./hack/test integration
 Set `TEST_KEEP_CACHE=1` for the test framework to keep external dependant images in a docker volume
 if you are repeatedly calling `./hack/test` script. This helps to avoid rate limiting on the remote registry side.
 
+You can also set `MOUNT_BUILDKIT_DOCKER_CONFIG_PATH` to forward docker config that will be used to pull
+test images into the container. Don't use your personal docker config, create a new one with a dedicated
+token that only has public read-only access.
+
 If you are working behind a proxy, you can set some of or all
 `HTTP_PROXY=http://ip:port`, `HTTPS_PROXY=http://ip:port`, `NO_PROXY=http://ip:port` for the test framework
 to specify the proxy build args.
diff --git a/hack/shell b/hack/shell
index 15ce006cbc21..87d09a762dec 100755
--- a/hack/shell
+++ b/hack/shell
@@ -20,5 +20,12 @@ if [ -n "$MOUNT_BUILDKIT_SOURCE" ]; then
   volumes="-v $(pwd):/src"
 fi
 
+config=
+if [ -n "$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH" ]; then
+  if [ -f "$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH" ]; then
+    config="-v $MOUNT_BUILDKIT_DOCKER_CONFIG_PATH:/root/.docker/config.json:ro"
+  fi
+fi
+
 set -x
-docker run $SSH $volumes -it --privileged -v /tmp -e BUILDKIT_REGISTRY_MIRROR_DIR=/root/.cache/registry --rm $(cat $iidfile) ash
+docker run $SSH $volumes $config -it --privileged -v /tmp -e BUILDKIT_REGISTRY_MIRROR_DIR=/root/.cache/registry --rm $(cat $iidfile) ash
diff --git a/hack/test b/hack/test
index 8fefbf38e6ee..85f07557b10d 100755
--- a/hack/test
+++ b/hack/test
@@ -29,6 +29,7 @@ set -eu -o pipefail
 : "${DOCKERFILE_RELEASES=}"
 : "${BUILDKIT_WORKER_RANDOM=}"
 : "${BUILDKIT_TEST_DISABLE_FEATURES=}"
+: "${MOUNT_BUILDKIT_DOCKER_CONFIG_PATH=}"
 
 if [ "$TEST_DOCKERD" == "1" ]; then
   if [ ! -f "$TEST_DOCKERD_BINARY" ]; then
@@ -108,8 +109,11 @@ if [ "$TEST_KEEP_CACHE" != "1" ]; then
 fi
 
 dockerConfigMount=""
-if [ "$GITHUB_ACTIONS" = "true" ]; then
+if [ "$GITHUB_ACTIONS" = "true" ] || [ -n "$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH" ]; then
   dockerConfigPath="$HOME/.docker/config.json"
+  if [ -n "$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH" ]; then
+    dockerConfigPath="$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH"
+  fi
   if [ -f "$dockerConfigPath" ]; then
     dockerConfigMount="-v $dockerConfigPath:/root/.docker/config.json:ro"
   fi