diff --git a/go.mod b/go.mod
index 54048b06d7..39fab4b5c1 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,9 @@ module github.com/google/ko
 
 go 1.16
 
+// TODO: remove
+replace github.com/google/go-containerregistry => ../go-containerregistry
+
 require (
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20211215200129-69c85dc22db6
 	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220119192733-fe33c00cee21
diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/google/auth.go b/vendor/github.com/google/go-containerregistry/pkg/v1/google/auth.go
index 4ce979577b..b3c887934d 100644
--- a/vendor/github.com/google/go-containerregistry/pkg/v1/google/auth.go
+++ b/vendor/github.com/google/go-containerregistry/pkg/v1/google/auth.go
@@ -55,7 +55,7 @@ func NewEnvAuthenticator() (authn.Authenticator, error) {
 
 	token, err := ts.Token()
 	if err != nil {
-		return nil, err
+		return authn.Anonymous, nil
 	}
 
 	return &tokenSourceAuth{oauth2.ReuseTokenSource(token, ts)}, nil
@@ -75,7 +75,7 @@ func NewGcloudAuthenticator() (authn.Authenticator, error) {
 	// Attempt to fetch a token to ensure gcloud is installed and we can run it.
 	token, err := ts.Token()
 	if err != nil {
-		return nil, err
+		return authn.Anonymous, nil
 	}
 
 	return &tokenSourceAuth{oauth2.ReuseTokenSource(token, ts)}, nil
diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/google/keychain.go b/vendor/github.com/google/go-containerregistry/pkg/v1/google/keychain.go
index 7471a01734..382dd6e264 100644
--- a/vendor/github.com/google/go-containerregistry/pkg/v1/google/keychain.go
+++ b/vendor/github.com/google/go-containerregistry/pkg/v1/google/keychain.go
@@ -15,7 +15,6 @@
 package google
 
 import (
-	"fmt"
 	"strings"
 	"sync"
 
@@ -55,7 +54,10 @@ type googleKeychain struct {
 func (gk *googleKeychain) Resolve(target authn.Resource) (authn.Authenticator, error) {
 	// Only authenticate GCR and AR so it works with authn.NewMultiKeychain to fallback.
 	host := target.RegistryStr()
-	if host != "gcr.io" && !strings.HasSuffix(host, ".gcr.io") && !strings.HasSuffix(host, ".pkg.dev") && !strings.HasSuffix(host, ".google.com") {
+	if host != "gcr.io" &&
+		!strings.HasSuffix(host, ".gcr.io") &&
+		!strings.HasSuffix(host, ".pkg.dev") &&
+		!strings.HasSuffix(host, ".google.com") {
 		return authn.Anonymous, nil
 	}
 
@@ -68,14 +70,13 @@ func (gk *googleKeychain) Resolve(target authn.Resource) (authn.Authenticator, e
 
 func resolve() (authn.Authenticator, error) {
 	auth, envErr := NewEnvAuthenticator()
-	if envErr == nil {
+	if envErr == nil && auth != authn.Anonymous {
 		return auth, nil
 	}
 
 	auth, gErr := NewGcloudAuthenticator()
-	if gErr == nil {
+	if gErr == nil && auth != authn.Anonymous {
 		return auth, nil
 	}
-
-	return nil, fmt.Errorf("failed to create token source from env: %v or gcloud: %v", envErr, gErr) //nolint: errorlint
+	return authn.Anonymous, nil
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 6031e6a2e7..bb4bc52d31 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -190,7 +190,7 @@ github.com/google/go-cmp/cmp/internal/diff
 github.com/google/go-cmp/cmp/internal/flags
 github.com/google/go-cmp/cmp/internal/function
 github.com/google/go-cmp/cmp/internal/value
-# github.com/google/go-containerregistry v0.8.1-0.20220202214207-9c35968ef47e
+# github.com/google/go-containerregistry v0.8.1-0.20220202214207-9c35968ef47e => ../go-containerregistry
 ## explicit
 github.com/google/go-containerregistry/cmd/crane/cmd
 github.com/google/go-containerregistry/internal/and
@@ -481,3 +481,4 @@ sigs.k8s.io/kind/pkg/internal/env
 sigs.k8s.io/kind/pkg/log
 # sigs.k8s.io/yaml v1.3.0
 sigs.k8s.io/yaml
+# github.com/google/go-containerregistry => ../go-containerregistry