diff --git a/cache/contenthash/checksum.go b/cache/contenthash/checksum.go
index 7b592c794f8ed..804198c17a03c 100644
--- a/cache/contenthash/checksum.go
+++ b/cache/contenthash/checksum.go
@@ -834,7 +834,7 @@ func (cc *cacheContext) scanChecksum(ctx context.Context, m *mount, p string, fo
 		return nil, err
 	}
 	if scan {
-		if err := cc.scanPath(ctx, m, p, followTrailing); err != nil {
+		if err := cc.scanPathWrapper(ctx, m, p, followTrailing); err != nil {
 			return nil, err
 		}
 	}
@@ -996,13 +996,6 @@ func (cc *cacheContext) needsScan(root *iradix.Node[*CacheRecord], path string,
 	return cr == nil && !hasParentInTree, nil
 }
 
-// Only used by TestNeedScanChecksumRegression to make sure scanPath is not
-// called for paths we have already scanned.
-var (
-	scanCounterEnable bool
-	scanCounter       atomic.Uint64
-)
-
 func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, followTrailing bool) (retErr error) {
 	p = path.Join("/", p)
 
@@ -1074,6 +1067,7 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, follow
 		}
 		return nil
 	})
+
 	if err != nil {
 		return err
 	}
@@ -1082,6 +1076,13 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, follow
 	return nil
 }
 
+// Only used by TestNeedScanChecksumRegression to make sure scanPath is not
+// called for paths we have already scanned.
+var (
+	scanCounterEnable bool
+	scanCounter       atomic.Uint64
+)
+
 // followLinksCallback is called after we try to resolve each element. If the
 // path was not found, cr is nil.
 type followLinksCallback func(path string, cr *CacheRecord) error
diff --git a/cache/contenthash/checksum_unix.go b/cache/contenthash/checksum_unix.go
new file mode 100644
index 0000000000000..f9a1abe0bca08
--- /dev/null
+++ b/cache/contenthash/checksum_unix.go
@@ -0,0 +1,8 @@
+//go:build !windows
+// +build !windows
+
+package contenthash
+
+func (cc *cacheContext) scanPathWrapper(ctx context.Context, m *mount, p string, trailing bool) error {
+	return cc.scanPath(ctx, m, p, trailing)
+}
diff --git a/cache/contenthash/checksum_windows.go b/cache/contenthash/checksum_windows.go
new file mode 100644
index 0000000000000..73152c5581616
--- /dev/null
+++ b/cache/contenthash/checksum_windows.go
@@ -0,0 +1,13 @@
+package contenthash
+
+import (
+	"context"
+	"github.com/Microsoft/go-winio"
+)
+
+func (cc *cacheContext) scanPathWrapper(ctx context.Context, m *mount, p string, trailing bool) error {
+	privileges := []string{winio.SeBackupPrivilege}
+	return winio.RunWithPrivileges(privileges, func() error {
+		return cc.scanPath(ctx, m, p, trailing)
+	})
+}