diff --git a/go.mod b/go.mod
index 54048b06d7..39fab4b5c1 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,9 @@ module github.com/google/ko
 
 go 1.16
 
+// TODO: remove
+replace github.com/google/go-containerregistry => ../go-containerregistry
+
 require (
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20211215200129-69c85dc22db6
 	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220119192733-fe33c00cee21
diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/google/keychain.go b/vendor/github.com/google/go-containerregistry/pkg/v1/google/keychain.go
index 7471a01734..193f843d79 100644
--- a/vendor/github.com/google/go-containerregistry/pkg/v1/google/keychain.go
+++ b/vendor/github.com/google/go-containerregistry/pkg/v1/google/keychain.go
@@ -15,11 +15,11 @@
 package google
 
 import (
-	"fmt"
 	"strings"
 	"sync"
 
 	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/logs"
 )
 
 // Keychain exports an instance of the google Keychain.
@@ -55,7 +55,10 @@ type googleKeychain struct {
 func (gk *googleKeychain) Resolve(target authn.Resource) (authn.Authenticator, error) {
 	// Only authenticate GCR and AR so it works with authn.NewMultiKeychain to fallback.
 	host := target.RegistryStr()
-	if host != "gcr.io" && !strings.HasSuffix(host, ".gcr.io") && !strings.HasSuffix(host, ".pkg.dev") && !strings.HasSuffix(host, ".google.com") {
+	if host != "gcr.io" &&
+		!strings.HasSuffix(host, ".gcr.io") &&
+		!strings.HasSuffix(host, ".pkg.dev") &&
+		!strings.HasSuffix(host, ".google.com") {
 		return authn.Anonymous, nil
 	}
 
@@ -68,14 +71,21 @@ func (gk *googleKeychain) Resolve(target authn.Resource) (authn.Authenticator, e
 
 func resolve() (authn.Authenticator, error) {
 	auth, envErr := NewEnvAuthenticator()
-	if envErr == nil {
+	if envErr == nil && auth != authn.Anonymous {
 		return auth, nil
 	}
 
 	auth, gErr := NewGcloudAuthenticator()
-	if gErr == nil {
+	if gErr == nil && auth != authn.Anonymous {
 		return auth, nil
 	}
 
-	return nil, fmt.Errorf("failed to create token source from env: %v or gcloud: %v", envErr, gErr) //nolint: errorlint
+	logs.Debug.Println("Failed to get any Google credentials, falling back to Anonymous")
+	if envErr != nil {
+		logs.Debug.Printf("Google env error: %v", envErr)
+	}
+	if gErr != nil {
+		logs.Debug.Printf("gcloud error: %v", gErr)
+	}
+	return authn.Anonymous, nil
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 6031e6a2e7..bb4bc52d31 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -190,7 +190,7 @@ github.com/google/go-cmp/cmp/internal/diff
 github.com/google/go-cmp/cmp/internal/flags
 github.com/google/go-cmp/cmp/internal/function
 github.com/google/go-cmp/cmp/internal/value
-# github.com/google/go-containerregistry v0.8.1-0.20220202214207-9c35968ef47e
+# github.com/google/go-containerregistry v0.8.1-0.20220202214207-9c35968ef47e => ../go-containerregistry
 ## explicit
 github.com/google/go-containerregistry/cmd/crane/cmd
 github.com/google/go-containerregistry/internal/and
@@ -481,3 +481,4 @@ sigs.k8s.io/kind/pkg/internal/env
 sigs.k8s.io/kind/pkg/log
 # sigs.k8s.io/yaml v1.3.0
 sigs.k8s.io/yaml
+# github.com/google/go-containerregistry => ../go-containerregistry