diff --git a/cache/contenthash/checksum.go b/cache/contenthash/checksum.go
index 7b592c794f8ed..dbe6e9d736113 100644
--- a/cache/contenthash/checksum.go
+++ b/cache/contenthash/checksum.go
@@ -996,13 +996,6 @@ func (cc *cacheContext) needsScan(root *iradix.Node[*CacheRecord], path string,
 	return cr == nil && !hasParentInTree, nil
 }
 
-// Only used by TestNeedScanChecksumRegression to make sure scanPath is not
-// called for paths we have already scanned.
-var (
-	scanCounterEnable bool
-	scanCounter       atomic.Uint64
-)
-
 func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, followTrailing bool) (retErr error) {
 	p = path.Join("/", p)
 
@@ -1034,7 +1027,7 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, follow
 		scanPath = resolvedPath
 	}
 
-	err = filepath.Walk(scanPath, func(itemPath string, fi os.FileInfo, err error) error {
+	walkFunc := func(itemPath string, fi os.FileInfo, err error) error {
 		if scanCounterEnable {
 			scanCounter.Add(1)
 		}
@@ -1073,7 +1066,10 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, follow
 			txn.Insert(k, cr)
 		}
 		return nil
-	})
+	}
+
+	err = cc.walk(scanPath, walkFunc)
+
 	if err != nil {
 		return err
 	}
@@ -1082,6 +1078,13 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, follow
 	return nil
 }
 
+// Only used by TestNeedScanChecksumRegression to make sure scanPath is not
+// called for paths we have already scanned.
+var (
+	scanCounterEnable bool
+	scanCounter       atomic.Uint64
+)
+
 // followLinksCallback is called after we try to resolve each element. If the
 // path was not found, cr is nil.
 type followLinksCallback func(path string, cr *CacheRecord) error
diff --git a/cache/contenthash/checksum_unix.go b/cache/contenthash/checksum_unix.go
new file mode 100644
index 0000000000000..444518ddd8142
--- /dev/null
+++ b/cache/contenthash/checksum_unix.go
@@ -0,0 +1,10 @@
+//go:build !windows
+// +build !windows
+
+package contenthash
+
+import "path/filepath"
+
+func (cc *cacheContext) walk(scanPath string, walkFunc filepath.WalkFunc) error {
+	return filepath.Walk(scanPath, walkFunc)
+}
diff --git a/cache/contenthash/checksum_windows.go b/cache/contenthash/checksum_windows.go
new file mode 100644
index 0000000000000..a1b7ec318bc37
--- /dev/null
+++ b/cache/contenthash/checksum_windows.go
@@ -0,0 +1,14 @@
+package contenthash
+
+import (
+	"path/filepath"
+
+	"github.com/Microsoft/go-winio"
+)
+
+func (cc *cacheContext) walk(scanPath string, walkFunc filepath.WalkFunc) error {
+	privileges := []string{winio.SeBackupPrivilege}
+	return winio.RunWithPrivileges(privileges, func() error {
+		return filepath.Walk(scanPath, walkFunc)
+	})
+}