diff --git a/__tests__/buildx/inputs.test.ts b/__tests__/buildx/inputs.test.ts
index 803759e8..c903ae7f 100644
--- a/__tests__/buildx/inputs.test.ts
+++ b/__tests__/buildx/inputs.test.ts
@@ -177,6 +177,21 @@ describe('resolveBuildSecret', () => {
       expect(e.message).toEqual(error?.message);
     }
   });
+
+  test.each([
+    ['FOO=bar', 'FOO', 'bar', null],
+    ['FOO=', 'FOO', '', new Error('FOO= is not a valid secret')],
+    ['=bar', '', '', new Error('=bar is not a valid secret')],
+    ['FOO=bar=baz', 'FOO', 'bar=baz', null]
+  ])('given %p key and %p env', async (kvp: string, exKey: string, exValue: string, error: Error | null) => {
+    try {
+      const secret = Inputs.resolveBuildSecretEnv(kvp);
+      expect(secret).toEqual(`id=${exKey},env="${exValue}"`);
+    } catch (e) {
+      // eslint-disable-next-line jest/no-conditional-expect
+      expect(e.message).toEqual(error?.message);
+    }
+  });
 });
 
 describe('hasLocalExporter', () => {
diff --git a/src/buildx/inputs.ts b/src/buildx/inputs.ts
index f5405dfa..7bf830c4 100644
--- a/src/buildx/inputs.ts
+++ b/src/buildx/inputs.ts
@@ -21,6 +21,18 @@ import {parse} from 'csv-parse/sync';
 
 import {Context} from '../context';
 
+const parseKvp = (kvp: string): [string, string] => {
+  const delimiterIndex = kvp.indexOf('=');
+  const key = kvp.substring(0, delimiterIndex);
+  const value = kvp.substring(delimiterIndex + 1);
+
+  if (key.length == 0 || value.length == 0) {
+    throw new Error(`${kvp} is not a valid secret`);
+  }
+
+  return [key, value];
+};
+
 export class Inputs {
   public static getBuildImageIDFilePath(): string {
     return path.join(Context.tmpDir(), 'iidfile');
@@ -70,13 +82,17 @@ export class Inputs {
     return Inputs.resolveBuildSecret(kvp, true);
   }
 
+  public static resolveBuildSecretEnv(kvp: string): string {
+    const [key, value] = parseKvp(kvp);
+
+    return `id=${key},env="${value}"`;
+  }
+
   public static resolveBuildSecret(kvp: string, file: boolean): string {
-    const delimiterIndex = kvp.indexOf('=');
-    const key = kvp.substring(0, delimiterIndex);
-    let value = kvp.substring(delimiterIndex + 1);
-    if (key.length == 0 || value.length == 0) {
-      throw new Error(`${kvp} is not a valid secret`);
-    }
+    const [key, _value] = parseKvp(kvp);
+
+    let value = _value;
+
     if (file) {
       if (!fs.existsSync(value)) {
         throw new Error(`secret file ${value} not found`);