Build ARG in Dockerfile doesn't invalidate cache

I have managed to make a more simple and minimal Dockerfile which you can use to recreate the bug:

FROM alpine:latest

ARG PASSWORD
RUN echo $PASSWORD > /password 


ENTRYPOINT ["cat", "/password"] 

Steps to recreate the cache bug:

1. Build this Dockerfile with docker build -t registry.digitalocean.com/myreg/failcache -f failcache.dockerfile --build-arg PASSWORD=test .

2. Push the image to DO container registry: docker push registry.digitalocean.com/myreg/failcache

3. Run the container somewhere. In particular you can use kubernetes with the following pod spec:

apiVersion: v1
kind: Pod
metadata:
  labels:
    app: failcache 
  name: failcache 
  namespace: keycloak
spec:
  serviceAccount: <sa-with-pull-access-to-registry>
  containers:
  - image: registry.digitalocean.com/myreg
    imagePullPolicy: Always
    name: failcache

4. Notice how the log of the container says “test”

5. Now rebuild the image locally with docker build -t registry.digitalocean.com/myreg/failcache -f failcache.dockerfile --build-arg PASSWORD=another-test .

6. Push the image again to DO container registry and recreate the pod from step 3. The container log will still say “test”, even though the build-arg has changed.

Any insights on this is highly appreciated!