diff --git a/remotes/docker/scope.go b/remotes/docker/scope.go
index fe57f023d..95b4810ab 100644
--- a/remotes/docker/scope.go
+++ b/remotes/docker/scope.go
@@ -74,7 +74,7 @@ func ContextWithAppendPullRepositoryScope(ctx context.Context, repo string) cont
 
 // GetTokenScopes returns deduplicated and sorted scopes from ctx.Value(tokenScopesKey{}) and common scopes.
 func GetTokenScopes(ctx context.Context, common []string) []string {
-	var scopes []string
+	scopes := []string{}
 	if x := ctx.Value(tokenScopesKey{}); x != nil {
 		scopes = append(scopes, x.([]string)...)
 	}
@@ -82,6 +82,10 @@ func GetTokenScopes(ctx context.Context, common []string) []string {
 	scopes = append(scopes, common...)
 	sort.Strings(scopes)
 
+	if len(scopes) == 0 {
+		return scopes
+	}
+
 	l := 0
 	for idx := 1; idx < len(scopes); idx++ {
 		// Note: this comparison is unaware of the scope grammar (https://docs.docker.com/registry/spec/auth/scope/)
diff --git a/remotes/docker/scope_test.go b/remotes/docker/scope_test.go
index a1229787e..42e9f7c13 100644
--- a/remotes/docker/scope_test.go
+++ b/remotes/docker/scope_test.go
@@ -63,6 +63,11 @@ func TestGetTokenScopes(t *testing.T) {
 		commonScopes []string
 		expected     []string
 	}{
+		{
+			scopesInCtx:  []string{},
+			commonScopes: []string{},
+			expected:     []string{},
+		},
 		{
 			scopesInCtx:  []string{},
 			commonScopes: []string{"repository:foo/bar:pull"},