diff --git a/go.mod b/go.mod
index 90dbe3ef90..4c06aad75e 100644
--- a/go.mod
+++ b/go.mod
@@ -55,7 +55,7 @@ require (
 	github.com/miekg/dns v1.1.66
 	github.com/mistifyio/go-zfs/v3 v3.0.1
 	github.com/mitchellh/copystructure v1.2.0
-	github.com/moby/buildkit v0.25.0-rc1 // TODO: remove custom ref in hack/buildkit-ref
+	github.com/moby/buildkit v0.25.0
 	github.com/moby/docker-image-spec v1.3.1
 	github.com/moby/go-archive v0.1.0
 	github.com/moby/ipvs v1.1.0
diff --git a/go.sum b/go.sum
index 6ebd5f5a4b..3b85ad8db5 100644
--- a/go.sum
+++ b/go.sum
@@ -392,8 +392,8 @@ github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:F
 github.com/mitchellh/mapstructure v0.0.0-20170523030023-d0303fe80992/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/moby/buildkit v0.25.0-rc1 h1:BX93yFRfF1LzD12wCOhjncbpL3RvkPa1+fF7xmsdr28=
-github.com/moby/buildkit v0.25.0-rc1/go.mod h1:phM8sdqnvgK2y1dPDnbwI6veUCXHOZ6KFSl6E164tkc=
+github.com/moby/buildkit v0.25.0 h1:cRgh74ymzyHxS5a/lsYT4OCyVU8iC3UgkwasIEUi0og=
+github.com/moby/buildkit v0.25.0/go.mod h1:phM8sdqnvgK2y1dPDnbwI6veUCXHOZ6KFSl6E164tkc=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
diff --git a/hack/buildkit-ref b/hack/buildkit-ref
index 6c5767607f..8e6577f7b0 100755
--- a/hack/buildkit-ref
+++ b/hack/buildkit-ref
@@ -19,9 +19,6 @@ if [[ "${buildkit_ref}" == *-*-* ]]; then
 	buildkit_ref=$(curl -s "https://api.github.com/repos/${buildkit_repo}/commits/${buildkit_ref}" | jq -r .sha)
 fi
 
-# Needed by v0.25.0-rc1
-buildkit_ref="e4d7acb44d7e29b594445a36c5cc28be44740142"
-
 cat << EOF
 BUILDKIT_REPO=$buildkit_repo
 BUILDKIT_REF=$buildkit_ref
diff --git a/vendor/github.com/moby/buildkit/source/git/source.go b/vendor/github.com/moby/buildkit/source/git/source.go
index 497990c43c..db586df519 100644
--- a/vendor/github.com/moby/buildkit/source/git/source.go
+++ b/vendor/github.com/moby/buildkit/source/git/source.go
@@ -531,7 +531,11 @@ func (gs *gitSourceHandler) Snapshot(ctx context.Context, g session.Group) (out
 			// local refs are needed so they would be advertised on next fetches. Force is used
 			// in case the ref is a branch and it now points to a different commit sha
 			// TODO: is there a better way to do this?
-			args = append(args, "--force", ref+":tags/"+ref)
+			targetRef := ref
+			if !strings.HasPrefix(ref, "refs/tags/") {
+				targetRef = "tags/" + ref
+			}
+			args = append(args, "--force", ref+":"+targetRef)
 		}
 		if _, err := git.Run(ctx, args...); err != nil {
 			return nil, errors.Wrapf(err, "failed to fetch remote %s", urlutil.RedactCredentials(gs.src.Remote))
@@ -615,7 +619,11 @@ func (gs *gitSourceHandler) Snapshot(ctx context.Context, g session.Group) (out
 
 		pullref := ref
 		if isAnnotatedTag {
-			pullref += ":refs/tags/" + pullref
+			targetRef := pullref
+			if !strings.HasPrefix(pullref, "refs/tags/") {
+				targetRef = "refs/tags/" + pullref
+			}
+			pullref += ":" + targetRef
 		} else if gitutil.IsCommitSHA(ref) {
 			pullref = "refs/buildkit/" + identity.NewID()
 			_, err = git.Run(ctx, "update-ref", pullref, ref)
diff --git a/vendor/github.com/moby/buildkit/util/grpcerrors/grpcerrors.go b/vendor/github.com/moby/buildkit/util/grpcerrors/grpcerrors.go
index a7bc287326..fcb63295a7 100644
--- a/vendor/github.com/moby/buildkit/util/grpcerrors/grpcerrors.go
+++ b/vendor/github.com/moby/buildkit/util/grpcerrors/grpcerrors.go
@@ -142,10 +142,20 @@ func Code(err error) codes.Code {
 	}
 
 	if wrapped, ok := err.(multiUnwrapper); ok {
+		var hasUnknown bool
+
 		for _, err := range wrapped.Unwrap() {
-			if c := Code(err); c != codes.OK && c != codes.Unknown {
+			c := Code(err)
+			if c != codes.OK && c != codes.Unknown {
 				return c
 			}
+			if c == codes.Unknown {
+				hasUnknown = true
+			}
+		}
+
+		if hasUnknown {
+			return codes.Unknown
 		}
 	}
 
@@ -159,7 +169,7 @@ func WrapCode(err error, code codes.Code) error {
 // AsGRPCStatus tries to extract a gRPC status from the error.
 // Supports  `Unwrap() error` and `Unwrap() []error` for wrapped errors.
 // When the `Unwrap() []error` returns multiple errors, the first one that
-// contains a gRPC status is returned.
+// contains a gRPC status that is not OK is returned with the full error message.
 func AsGRPCStatus(err error) (*status.Status, bool) {
 	if err == nil {
 		return nil, true
@@ -178,8 +188,17 @@ func AsGRPCStatus(err error) (*status.Status, bool) {
 
 	if wrapped, ok := err.(multiUnwrapper); ok {
 		for _, err := range wrapped.Unwrap() {
-			if st, ok := AsGRPCStatus(err); ok && st != nil {
-				return st, true
+			st, ok := AsGRPCStatus(err)
+			if !ok {
+				continue
+			}
+
+			if st != nil && st.Code() != codes.OK {
+				// Copy the full status so we can set the full error message
+				// Does the proto conversion so can keep any extra details.
+				proto := st.Proto()
+				proto.Message = err.Error()
+				return status.FromProto(proto), true
 			}
 		}
 	}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 2ca658dc7f..e2407ff49b 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -753,7 +753,7 @@ github.com/mitchellh/hashstructure/v2
 # github.com/mitchellh/reflectwalk v1.0.2
 ## explicit
 github.com/mitchellh/reflectwalk
-# github.com/moby/buildkit v0.25.0-rc1
+# github.com/moby/buildkit v0.25.0
 ## explicit; go 1.24.0
 github.com/moby/buildkit/api/services/control
 github.com/moby/buildkit/api/types