diff --git a/src/main/kotlin/io/github/sgtsilvio/gradle/oci/internal/registry/OciRegistryApi.kt b/src/main/kotlin/io/github/sgtsilvio/gradle/oci/internal/registry/OciRegistryApi.kt
index 97fa2aa3..3962bda1 100644
--- a/src/main/kotlin/io/github/sgtsilvio/gradle/oci/internal/registry/OciRegistryApi.kt
+++ b/src/main/kotlin/io/github/sgtsilvio/gradle/oci/internal/registry/OciRegistryApi.kt
@@ -577,15 +577,16 @@ internal class OciRegistryApi(httpClient: HttpClient) {
                 }
                 val registryToken = OciRegistryToken(token)
                 val grantedScopes = registryToken.claims?.scopes
-                if ((grantedScopes == null) || (grantedScopes == key.scopes)) {
-                    registryToken
-                } else {
-                    tokenCache.asMap().putIfAbsent(
-                        key.copy(scopes = grantedScopes),
-                        CompletableFuture.completedFuture(registryToken),
-                    )
+                if ((grantedScopes != null) && (grantedScopes != key.scopes)) {
+                    if (grantedScopes.isNotEmpty()) {
+                        tokenCache.asMap().putIfAbsent(
+                            key.copy(scopes = grantedScopes),
+                            CompletableFuture.completedFuture(registryToken),
+                        )
+                    }
                     throw InsufficientScopesException(key.scopes, grantedScopes)
                 }
+                registryToken
             }
         }.map { encodeBearerAuthorization(it.token) }
     }