diff --git a/bake/entitlements_test.go b/bake/entitlements_test.go
index c3ac586f337b..91071bcdcdca 100644
--- a/bake/entitlements_test.go
+++ b/bake/entitlements_test.go
@@ -343,6 +343,31 @@ func TestValidateEntitlements(t *testing.T) {
 			conf: EntitlementConf{
 				FSRead: []string{"/"},
 			},
+			expected: EntitlementConf{
+				FSRead: func() []string {
+					// on windows root (/) is only allowed if it is the same volume as wd
+					if filepath.VolumeName(wd) == filepath.VolumeName(escapeLink) {
+						return nil
+					}
+					// if not, then escapeLink is not allowed
+					p, err := evaluateToExistingPath(escapeLink)
+					require.NoError(t, err)
+					return []string{p}
+				}(),
+			},
+		},
+		{
+			name: "SecretFromEscapeLinkAllowWildcard",
+			opt: build.Options{
+				SecretSpecs: []*pb.Secret{
+					{
+						FilePath: escapeLink,
+					},
+				},
+			},
+			conf: EntitlementConf{
+				FSRead: []string{"*"},
+			},
 			expected: EntitlementConf{},
 		},
 	}
diff --git a/bake/entitlements_unix.go b/bake/entitlements_unix.go
index 660bc6fe6923..8c90a910628c 100644
--- a/bake/entitlements_unix.go
+++ b/bake/entitlements_unix.go
@@ -12,6 +12,9 @@ import (
 func evaluatePaths(in []string) ([]string, error) {
 	out := make([]string, 0, len(in))
 	for _, p := range in {
+		if p == "*" {
+			p = "/"
+		}
 		v, err := filepath.Abs(p)
 		if err != nil {
 			return nil, err
diff --git a/bake/entitlements_windows.go b/bake/entitlements_windows.go
index c1cda8c07389..400fe115c568 100644
--- a/bake/entitlements_windows.go
+++ b/bake/entitlements_windows.go
@@ -10,7 +10,7 @@ import (
 func evaluatePaths(in []string) ([]string, error) {
 	out := make([]string, 0, len(in))
 	for _, p := range in {
-		if p == "/" {
+		if p == "*" {
 			out = append(out, getAllVolumes()...)
 			continue
 		}