diff --git a/cli/command/manifest/annotate.go b/cli/command/manifest/annotate.go
index 2a0a49893b..0f2a10aade 100644
--- a/cli/command/manifest/annotate.go
+++ b/cli/command/manifest/annotate.go
@@ -1,6 +1,7 @@
 package manifest
 
 import (
+	"context"
 	"fmt"
 	"path/filepath"
 
@@ -8,6 +9,8 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/config"
 	"github.com/docker/cli/cli/manifest/store"
+	registryclient "github.com/docker/cli/cli/registry/client"
+	"github.com/docker/docker/api/types/registry"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
@@ -27,6 +30,7 @@ type annotateOptions struct {
 type manifestStoreProvider interface {
 	// ManifestStore returns a store for local manifests
 	ManifestStore() store.Store
+	RegistryClient(bool) registryclient.RegistryClient
 }
 
 // newManifestStore returns a store for local manifests
@@ -40,6 +44,19 @@ func newManifestStore(dockerCLI command.Cli) store.Store {
 	return store.NewStore(filepath.Join(config.Dir(), "manifests"))
 }
 
+// newRegistryClient returns a client for communicating with a Docker distribution
+// registry
+func newRegistryClient(dockerCLI command.Cli, allowInsecure bool) registryclient.RegistryClient {
+	if msp, ok := dockerCLI.(manifestStoreProvider); ok {
+		// manifestStoreProvider is used in tests to provide a dummy store.
+		return msp.RegistryClient(allowInsecure)
+	}
+	resolver := func(ctx context.Context, index *registry.IndexInfo) registry.AuthConfig {
+		return command.ResolveAuthConfig(dockerCLI.ConfigFile(), index)
+	}
+	return registryclient.NewRegistryClient(resolver, command.UserAgent(), allowInsecure)
+}
+
 // NewAnnotateCommand creates a new `docker manifest annotate` command
 func newAnnotateCommand(dockerCli command.Cli) *cobra.Command {
 	var opts annotateOptions
diff --git a/cli/command/manifest/inspect.go b/cli/command/manifest/inspect.go
index ee68acf3c9..217383a07f 100644
--- a/cli/command/manifest/inspect.go
+++ b/cli/command/manifest/inspect.go
@@ -75,7 +75,7 @@ func runInspect(ctx context.Context, dockerCli command.Cli, opts inspectOptions)
 	}
 
 	// Next try a remote manifest
-	registryClient := dockerCli.RegistryClient(opts.insecure)
+	registryClient := newRegistryClient(dockerCli, opts.insecure)
 	imageManifest, err := registryClient.GetManifest(ctx, namedRef)
 	if err == nil {
 		return printManifest(dockerCli, imageManifest, opts)
diff --git a/cli/command/manifest/push.go b/cli/command/manifest/push.go
index 97bdab6cbc..ccfa84cd6c 100644
--- a/cli/command/manifest/push.go
+++ b/cli/command/manifest/push.go
@@ -248,7 +248,7 @@ func buildPutManifestRequest(imageManifest types.ImageManifest, targetRef refere
 }
 
 func pushList(ctx context.Context, dockerCLI command.Cli, req pushRequest) error {
-	rclient := dockerCLI.RegistryClient(req.insecure)
+	rclient := newRegistryClient(dockerCLI, req.insecure)
 
 	if err := mountBlobs(ctx, rclient, req.targetRef, req.manifestBlobs); err != nil {
 		return err
diff --git a/cli/command/manifest/util.go b/cli/command/manifest/util.go
index 929f646bcc..be9fe9ea1b 100644
--- a/cli/command/manifest/util.go
+++ b/cli/command/manifest/util.go
@@ -69,15 +69,15 @@ func normalizeReference(ref string) (reference.Named, error) {
 
 // getManifest from the local store, and fallback to the remote registry if it
 // doesn't exist locally
-func getManifest(ctx context.Context, dockerCli command.Cli, listRef, namedRef reference.Named, insecure bool) (types.ImageManifest, error) {
-	data, err := newManifestStore(dockerCli).Get(listRef, namedRef)
+func getManifest(ctx context.Context, dockerCLI command.Cli, listRef, namedRef reference.Named, insecure bool) (types.ImageManifest, error) {
+	data, err := newManifestStore(dockerCLI).Get(listRef, namedRef)
 	switch {
 	case store.IsNotFound(err):
-		return dockerCli.RegistryClient(insecure).GetManifest(ctx, namedRef)
+		return newRegistryClient(dockerCLI, insecure).GetManifest(ctx, namedRef)
 	case err != nil:
 		return types.ImageManifest{}, err
 	case len(data.Raw) == 0:
-		return dockerCli.RegistryClient(insecure).GetManifest(ctx, namedRef)
+		return newRegistryClient(dockerCLI, insecure).GetManifest(ctx, namedRef)
 	default:
 		return data, nil
 	}