diff --git a/cache/contenthash/tarsum.go b/cache/contenthash/tarsum.go
index 3327ab2c208c..de72d6cdd0ab 100644
--- a/cache/contenthash/tarsum.go
+++ b/cache/contenthash/tarsum.go
@@ -39,7 +39,7 @@ func v1TarHeaderSelect(h *tar.Header) (orderedHeaders [][2]string) {
 	// Get extended attributes.
 	xAttrKeys := make([]string, len(h.Xattrs))
 	for k := range h.Xattrs {
-		if !strings.HasPrefix(k, "security.") && !strings.HasPrefix(k, "system.") {
+		if k == "security.capability" || !strings.HasPrefix(k, "security.") && !strings.HasPrefix(k, "system.") {
 			xAttrKeys = append(xAttrKeys, k)
 		}
 	}