Does SFDX jwt authorization work for scratch orgs as well?

Question

According to the documentation available here https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_jwt_flow.htm it is explicitly mentioned that:

You can authorize a scratch org using the same client identifier (consumer key) and private key file that you used to authorize its associated Dev Hub org. Set the --instanceurl parameter to https://test.salesforce.com and the --username parameter to the administrator user displayed after you create the scratch org with

However, when we try the following commands

 sfdx force:auth:jwt:grant --clientid $CLIENT_ID \
      --username my.email@gmail.com \
      --jwtkeyfile jwt-file \
      --instanceurl https://login.salesforce.com 
sfdx force:auth:jwt:grant --clientid $CLIENT_ID \
     --username test-twcxnbl2zyrl@example.com \
     --jwtkeyfile jwt-file \
     --instanceurl https://test.salesforce.com 

The first one results in Successfully authorized while the second fails with This org appears to have a problem with its OAuth configuration. Reason: invalid_grant - user hasn't approved this consumer

Is the documentation missing something, is there anything that should be done on the scratch org to enable jwt? The connected apps section in the scratch org is empy and our scratch definition looks like so

{
  "orgName": "my-playground",
  "edition": "Developer",
  "features": [],
  "language": "en_US",
  "settings": {
    "orgPreferenceSettings": {
      "s1DesktopEnabled": true
    }
  }
}