diff --git a/pkg/imgutil/dockerconfigresolver/credentialsstore.go b/pkg/imgutil/dockerconfigresolver/credentialsstore.go
index 86e5393a20f..b08deba271c 100644
--- a/pkg/imgutil/dockerconfigresolver/credentialsstore.go
+++ b/pkg/imgutil/dockerconfigresolver/credentialsstore.go
@@ -83,7 +83,7 @@ func (cs *CredentialsStore) Store(registryURL *RegistryURL, credentials *Credent
 	if registryURL.Namespace != nil {
 		credentials.ServerAddress = fmt.Sprintf("%s%s?%s", registryURL.Host, registryURL.Path, registryURL.RawQuery)
 	} else {
-		credentials.ServerAddress = registryURL.Host
+		credentials.ServerAddress = registryURL.CanonicalIdentifier()
 	}
 
 	// XXX future namespaced url likely require special handling here
diff --git a/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go b/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
index 6e83bc30584..a9890dffdcd 100644
--- a/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
+++ b/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
@@ -393,3 +393,5 @@ func TestWorkingCredentialsStore(t *testing.T) {
 
 	})
 }
+
+// TODO: add more tests that write credentials (specifically to hub locations) to verify they use the canonical id properly
diff --git a/pkg/imgutil/dockerconfigresolver/registryurl_test.go b/pkg/imgutil/dockerconfigresolver/registryurl_test.go
index 02bb0eb64c4..d10a02028e2 100644
--- a/pkg/imgutil/dockerconfigresolver/registryurl_test.go
+++ b/pkg/imgutil/dockerconfigresolver/registryurl_test.go
@@ -38,6 +38,11 @@ func TestURLParsingAndID(t *testing.T) {
 			address: "whatever://",
 			error:   ErrUnsupportedScheme,
 		},
+		{
+			address:    "",
+			identifier: "https://index.docker.io/v1/",
+			allIDs:     []string{"https://index.docker.io/v1/"},
+		},
 		{
 			address:    "https://index.docker.io/v1/",
 			identifier: "https://index.docker.io/v1/",