diff --git a/metropolis/node/core/update/BUILD.bazel b/metropolis/node/core/update/BUILD.bazel
index 73f6773..ed98d21 100644
--- a/metropolis/node/core/update/BUILD.bazel
+++ b/metropolis/node/core/update/BUILD.bazel
@@ -18,6 +18,7 @@
         "//osbase/efivarfs",
         "//osbase/gpt",
         "//osbase/kexec",
+        "//osbase/oci",
         "//osbase/oci/osimage",
         "//osbase/oci/registry",
         "@com_github_cenkalti_backoff_v4//:backoff",
diff --git a/metropolis/node/core/update/e2e/e2e_test.go b/metropolis/node/core/update/e2e/e2e_test.go
index 890a06f..041de3f 100644
--- a/metropolis/node/core/update/e2e/e2e_test.go
+++ b/metropolis/node/core/update/e2e/e2e_test.go
@@ -141,7 +141,7 @@
 		Port: 80,
 	}
 
-	imageX, err := oci.ReadLayout(xImageXPath)
+	imageX, err := oci.AsImage(oci.ReadLayout(xImageXPath))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -160,8 +160,8 @@
 	}
 
 	registryServer := registry.NewServer()
-	registryServer.AddImage("testos", "y", imageY)
-	registryServer.AddImage("testos", "z", imageZ)
+	registryServer.AddRef("testos", "y", imageY)
+	registryServer.AddRef("testos", "z", imageZ)
 	registryLis, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal(err)
@@ -225,8 +225,8 @@
 		"-device", "virtio-rng-pci",
 		"-serial", "stdio",
 		"-no-reboot",
-		"-fw_cfg", "name=opt/testos_y_digest,string=" + imageY.ManifestDigest,
-		"-fw_cfg", "name=opt/testos_z_digest,string=" + imageZ.ManifestDigest,
+		"-fw_cfg", "name=opt/testos_y_digest,string=" + imageY.Digest(),
+		"-fw_cfg", "name=opt/testos_z_digest,string=" + imageZ.Digest(),
 	}
 	return qemuArgs
 }
diff --git a/metropolis/node/core/update/update.go b/metropolis/node/core/update/update.go
index 66e7501..047e9f8 100644
--- a/metropolis/node/core/update/update.go
+++ b/metropolis/node/core/update/update.go
@@ -32,6 +32,7 @@
 	"source.monogon.dev/osbase/efivarfs"
 	"source.monogon.dev/osbase/gpt"
 	"source.monogon.dev/osbase/kexec"
+	"source.monogon.dev/osbase/oci"
 	"source.monogon.dev/osbase/oci/osimage"
 	"source.monogon.dev/osbase/oci/registry"
 
@@ -289,7 +290,7 @@
 		Repository: imageRef.Repository,
 	}
 
-	image, err := client.Read(downloadCtx, imageRef.Tag, imageRef.Digest)
+	image, err := oci.AsImage(client.Read(downloadCtx, imageRef.Tag, imageRef.Digest))
 	if err != nil {
 		return fmt.Errorf("failed to fetch OS image: %w", err)
 	}