diff --git a/bake/bake.go b/bake/bake.go
index 23ac031f17dc..54c19a159938 100644
--- a/bake/bake.go
+++ b/bake/bake.go
@@ -2,7 +2,6 @@ package bake
 
 import (
 	"context"
-	"encoding/csv"
 	"io"
 	"os"
 	"path"
@@ -27,6 +26,7 @@ import (
 	"github.com/moby/buildkit/client/llb"
 	"github.com/moby/buildkit/session/auth/authprovider"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 	"github.com/zclconf/go-cty/cty"
 	"github.com/zclconf/go-cty/cty/convert"
 )
@@ -1393,8 +1393,7 @@ func removeAttestDupes(s []string) []string {
 }
 
 func parseOutput(str string) map[string]string {
-	csvReader := csv.NewReader(strings.NewReader(str))
-	fields, err := csvReader.Read()
+	fields, err := csvvalue.Fields(str, nil)
 	if err != nil {
 		return nil
 	}
diff --git a/builder/builder.go b/builder/builder.go
index dbd7d4cfcc02..b603120fd119 100644
--- a/builder/builder.go
+++ b/builder/builder.go
@@ -2,7 +2,6 @@ package builder
 
 import (
 	"context"
-	"encoding/csv"
 	"encoding/json"
 	"net/url"
 	"os"
@@ -27,6 +26,7 @@ import (
 	"github.com/moby/buildkit/util/progress/progressui"
 	"github.com/pkg/errors"
 	"github.com/spf13/pflag"
+	"github.com/tonistiigi/go-csvvalue"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -601,8 +601,7 @@ func csvToMap(in []string) (map[string]string, error) {
 	}
 	m := make(map[string]string, len(in))
 	for _, s := range in {
-		csvReader := csv.NewReader(strings.NewReader(s))
-		fields, err := csvReader.Read()
+		fields, err := csvvalue.Fields(s, nil)
 		if err != nil {
 			return nil, err
 		}
diff --git a/commands/build.go b/commands/build.go
index c3b40bd707b2..7861b10b7b5b 100644
--- a/commands/build.go
+++ b/commands/build.go
@@ -5,7 +5,6 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
-	"encoding/csv"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -59,6 +58,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
+	"github.com/tonistiigi/go-csvvalue"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/metric"
 	"google.golang.org/grpc/codes"
@@ -982,9 +982,9 @@ func (cfg *invokeConfig) parseInvokeConfig(invoke, on string) error {
 		return nil
 	}
 
-	csvReader := csv.NewReader(strings.NewReader(invoke))
-	csvReader.LazyQuotes = true
-	fields, err := csvReader.Read()
+	csvParser := csvvalue.NewParser()
+	csvParser.LazyQuotes = true
+	fields, err := csvParser.Fields(invoke, nil)
 	if err != nil {
 		return err
 	}
diff --git a/util/buildflags/attests.go b/util/buildflags/attests.go
index 71150d2727a4..600b755e0d9a 100644
--- a/util/buildflags/attests.go
+++ b/util/buildflags/attests.go
@@ -1,13 +1,13 @@
 package buildflags
 
 import (
-	"encoding/csv"
 	"fmt"
 	"strconv"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 func CanonicalizeAttest(attestType string, in string) string {
@@ -45,8 +45,7 @@ func ParseAttest(in string) (*controllerapi.Attest, error) {
 		return nil, nil
 	}
 
-	csvReader := csv.NewReader(strings.NewReader(in))
-	fields, err := csvReader.Read()
+	fields, err := csvvalue.Fields(in, nil)
 	if err != nil {
 		return nil, err
 	}
diff --git a/util/buildflags/cache.go b/util/buildflags/cache.go
index 866ed0ffd5cd..7e0971b2672e 100644
--- a/util/buildflags/cache.go
+++ b/util/buildflags/cache.go
@@ -2,20 +2,19 @@ package buildflags
 
 import (
 	"context"
-	"encoding/csv"
 	"os"
 	"strings"
 
 	awsconfig "github.com/aws/aws-sdk-go-v2/config"
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 func ParseCacheEntry(in []string) ([]*controllerapi.CacheOptionsEntry, error) {
 	outs := make([]*controllerapi.CacheOptionsEntry, 0, len(in))
 	for _, in := range in {
-		csvReader := csv.NewReader(strings.NewReader(in))
-		fields, err := csvReader.Read()
+		fields, err := csvvalue.Fields(in, nil)
 		if err != nil {
 			return nil, err
 		}
diff --git a/util/buildflags/export.go b/util/buildflags/export.go
index 8f484c01ac2a..2a2832bded13 100644
--- a/util/buildflags/export.go
+++ b/util/buildflags/export.go
@@ -1,7 +1,6 @@
 package buildflags
 
 import (
-	"encoding/csv"
 	"regexp"
 	"strings"
 
@@ -11,6 +10,7 @@ import (
 	"github.com/moby/buildkit/exporter/containerimage/exptypes"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 func ParseExports(inp []string) ([]*controllerapi.ExportEntry, error) {
@@ -19,8 +19,7 @@ func ParseExports(inp []string) ([]*controllerapi.ExportEntry, error) {
 		return nil, nil
 	}
 	for _, s := range inp {
-		csvReader := csv.NewReader(strings.NewReader(s))
-		fields, err := csvReader.Read()
+		fields, err := csvvalue.Fields(s, nil)
 		if err != nil {
 			return nil, err
 		}
diff --git a/util/buildflags/printfunc.go b/util/buildflags/printfunc.go
index 1019702f1a8b..c6281069a3d8 100644
--- a/util/buildflags/printfunc.go
+++ b/util/buildflags/printfunc.go
@@ -1,12 +1,12 @@
 package buildflags
 
 import (
-	"encoding/csv"
 	"strconv"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 const defaultPrintFunc = "build"
@@ -16,8 +16,7 @@ func ParsePrintFunc(str string) (*controllerapi.PrintFunc, error) {
 		return nil, nil
 	}
 
-	csvReader := csv.NewReader(strings.NewReader(str))
-	fields, err := csvReader.Read()
+	fields, err := csvvalue.Fields(str, nil)
 	if err != nil {
 		return nil, err
 	}
diff --git a/util/buildflags/secrets.go b/util/buildflags/secrets.go
index 251120850ebc..2e4422979495 100644
--- a/util/buildflags/secrets.go
+++ b/util/buildflags/secrets.go
@@ -1,11 +1,11 @@
 package buildflags
 
 import (
-	"encoding/csv"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 func ParseSecretSpecs(sl []string) ([]*controllerapi.Secret, error) {
@@ -21,8 +21,7 @@ func ParseSecretSpecs(sl []string) ([]*controllerapi.Secret, error) {
 }
 
 func parseSecret(value string) (*controllerapi.Secret, error) {
-	csvReader := csv.NewReader(strings.NewReader(value))
-	fields, err := csvReader.Read()
+	fields, err := csvvalue.Fields(value, nil)
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to parse csv secret")
 	}