diff --git a/pkg/build/buildopts.go b/pkg/build/buildopts.go
index fb77643..fb78fc2 100644
--- a/pkg/build/buildopts.go
+++ b/pkg/build/buildopts.go
@@ -241,11 +241,21 @@ func NewBuildOpts(ctx context.Context, basePath string, contextMap map[string][]
 		return args, nil
 	}
 
-	sshExtract := func(key string) []sshprovider.AgentConfig {
+	sshExtract := func(key string) ([]sshprovider.AgentConfig, error) {
 		values, ok := contextMap[key]
 		if !ok {
-			return nil
+			return nil, nil
 		}
+		// Only --ssh default is supported for now, so all other cases are rejected.
+		if len(values) != 1 {
+			return nil, ErrUnsupportedSSH
+		}
+
+		value := strings.TrimSpace(values[0])
+		if value != "default" {
+			return nil, ErrUnsupportedSSH
+		}
+
 		agentConfigs := make([]sshprovider.AgentConfig, 0, len(values))
 		for _, value := range values {
 			id, path, hasPath := strings.Cut(value, "=")
@@ -267,7 +277,7 @@ func NewBuildOpts(ctx context.Context, basePath string, contextMap map[string][]
 			}
 			agentConfigs = append(agentConfigs, config)
 		}
-		return agentConfigs
+		return agentConfigs, nil
 	}
 
 	labels := mapExtract(KeyLabels)
@@ -276,7 +286,10 @@ func NewBuildOpts(ctx context.Context, basePath string, contextMap map[string][]
 	if err != nil {
 		return nil, err
 	}
-	ssh := sshExtract(KeySSH)
+	ssh, err := sshExtract(KeySSH)
+	if err != nil {
+		return nil, err
+	}
 	cacheIn := contextMap[KeyCacheIn]
 	cacheOut := contextMap[KeyCacheOut]
 	outputs := contextMap[KeyOutput]
diff --git a/pkg/build/errors.go b/pkg/build/errors.go
index 04a603b..80f6e82 100644
--- a/pkg/build/errors.go
+++ b/pkg/build/errors.go
@@ -28,4 +28,5 @@ var (
 	ErrNoBuildDirectives         = fmt.Errorf("no build directives")
 	ErrInvalidImageContextFormat = fmt.Errorf("image resolver: image name format is invalid")
 	ErrInvalidProgress           = fmt.Errorf("build arg progress value is invalid")
+	ErrUnsupportedSSH            = fmt.Errorf("build arg ssh value is not supported")
 )