diff --git a/go.mod b/go.mod
index 4be2634..60599b2 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.27.1
 require (
 	github.com/compose-spec/compose-go/v2 v2.15.0
 	github.com/google/go-cmp v0.7.0
-	github.com/moby/buildkit v0.33.0
+	github.com/moby/buildkit v0.33.1
 	github.com/olareg/olareg v0.2.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
diff --git a/go.sum b/go.sum
index 3d674b2..bb6703b 100644
--- a/go.sum
+++ b/go.sum
@@ -447,8 +447,8 @@ github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwX
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c h1:cqn374mizHuIWj+OSJCajGr/phAmuMug9qIX3l9CflE=
 github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/buildkit v0.33.0 h1:zBbt1FiMcTB/oFg1iCNcKa83k5Rn8MGcVjXFIcfYhuQ=
-github.com/moby/buildkit v0.33.0/go.mod h1:uNKSZnfMk1aSa18JiCR5BT68M/3jIDGo6XuAByUK3ek=
+github.com/moby/buildkit v0.33.1 h1:UUrdifmRdRadykO+f5l8BT1CseUXst2sJHV7AmkjjxE=
+github.com/moby/buildkit v0.33.1/go.mod h1:584wW8T/WG4O+lpXUCoDaWEc5e+rTGC3iP+l9mNcX8E=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.3.0 h1:nos4BtzzUIqB406BgQnWGMI4qib9BZ8XUHU+ucv/n1c=
diff --git a/ocitest/ocitest.go b/ocitest/ocitest.go
index 1d616d7..c2dca2f 100644
--- a/ocitest/ocitest.go
+++ b/ocitest/ocitest.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"encoding/json"
+	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
@@ -17,6 +18,7 @@ import (
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"oras.land/oras-go/v2/registry/remote"
+	"oras.land/oras-go/v2/registry/remote/auth"
 )
 
 // The media types the Features distribution specification mandates for a Feature artifact's config
@@ -112,6 +114,11 @@ func pushArtifact(t *testing.T, host, repo, tag string,
 		t.Fatal(err)
 	}
 	repository.PlainHTTP = true
+	// A private transport keeps this push alive when a parallel test's httptest.Server.Close
+	// closes the idle connections of http.DefaultTransport, which oras-go uses by default.
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	t.Cleanup(transport.CloseIdleConnections)
+	repository.Client = &auth.Client{Client: &http.Client{Transport: transport}}
 
 	push := func(mediaType string, data []byte) ocispec.Descriptor {
 		desc := ocispec.Descriptor{