diff --git a/cloud/agent/BUILD.bazel b/cloud/agent/BUILD.bazel
index a25ea38..765d63c 100644
--- a/cloud/agent/BUILD.bazel
+++ b/cloud/agent/BUILD.bazel
@@ -22,6 +22,7 @@
         "//osbase/efivarfs",
         "//osbase/net/proto",
         "//osbase/nvme",
+        "//osbase/oci",
         "//osbase/oci/osimage",
         "//osbase/oci/registry",
         "//osbase/pki",
diff --git a/cloud/agent/e2e/main_test.go b/cloud/agent/e2e/main_test.go
index 53b719b..9dfd129 100644
--- a/cloud/agent/e2e/main_test.go
+++ b/cloud/agent/e2e/main_test.go
@@ -115,7 +115,7 @@
 				Host:       registryAddr.String(),
 				Repository: "testos",
 				Tag:        "latest",
-				Digest:     image.ManifestDigest,
+				Digest:     image.Digest(),
 			},
 			NodeParameters: &mpb.NodeParameters{},
 			RootDevice:     "vda",
@@ -179,7 +179,7 @@
 	grpcListenAddr := grpcLis.Addr().(*net.TCPAddr)
 
 	registryServer := registry.NewServer()
-	registryServer.AddImage("testos", "latest", image)
+	registryServer.AddRef("testos", "latest", image)
 
 	registryLis, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
diff --git a/cloud/agent/install.go b/cloud/agent/install.go
index 9ada49b..9144769 100644
--- a/cloud/agent/install.go
+++ b/cloud/agent/install.go
@@ -21,6 +21,7 @@
 	metropolisInstall "source.monogon.dev/metropolis/installer/install"
 	"source.monogon.dev/osbase/blockdev"
 	"source.monogon.dev/osbase/efivarfs"
+	"source.monogon.dev/osbase/oci"
 	"source.monogon.dev/osbase/oci/osimage"
 	"source.monogon.dev/osbase/oci/registry"
 	"source.monogon.dev/osbase/structfs"
@@ -75,7 +76,7 @@
 		Repository: req.OsImage.Repository,
 	}
 
-	image, err := client.Read(ctx, req.OsImage.Tag, req.OsImage.Digest)
+	image, err := oci.AsImage(client.Read(ctx, req.OsImage.Tag, req.OsImage.Digest))
 	if err != nil {
 		return fmt.Errorf("failed to fetch OS image: %w", err)
 	}