docker access denied for registry.gitlab.com images on SaaS runners

Affected images

registry.gitlab.com/security-products/gemnasium:4
registry.gitlab.com/security-products/nodejs-scan:4
registry.gitlab.com/security-products/secrets:5
registry.gitlab.com/security-products/semgrep:4
registry.gitlab.com/gitlab-org/cloud-deploy/aws-base:latest

Expected behavior

SaaS (shared) runners pull the affected GitLab-hosted images succesfully.

Actual behavior

Example pipeline output:

Running with gitlab-runner 16.1.0~beta.59.g83c66823 (83c66823)
  on blue-2.shared.runners-manager.gitlab.com/default XxUrkriX, system ID: s_90897a2659b5
  feature flags: FF_USE_IMPROVED_URL_MASKING:true
Resolving secrets
00:00
Preparing the "docker+machine" executor
00:04
Using Docker executor with image registry.gitlab.com/security-products/gemnasium:4 ...
Authenticating with credentials from job payload (GitLab Registry)
Pulling docker image registry.gitlab.com/security-products/gemnasium:4 ...
WARNING: Failed to pull image with policy "always": Error response from daemon: pull access denied for registry.gitlab.com/security-products/gemnasium, repository does not exist or may require 'docker login': denied: requested access to the resource is denied (manager.go:237:0s)
ERROR: Job failed: failed to pull image "registry.gitlab.com/security-products/gemnasium:4" with specified policies [always]: Error response from daemon: pull access denied for registry.gitlab.com/security-products/gemnasium, repository does not exist or may require 'docker login': denied: requested access to the resource is denied (manager.go:237:0s)