diff --git a/go.mod b/go.mod
index 5848f0996..ef37e34f2 100644
--- a/go.mod
+++ b/go.mod
@@ -28,7 +28,7 @@ require (
 	github.com/moby/term v0.5.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
-	github.com/oras-project/oras-go/v3 v3.0.3-dev
+	github.com/oras-project/oras-go/v3 v3.0.0-rc.1
 	github.com/rubenv/sql-migrate v1.8.1
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/spf13/cobra v1.10.2
diff --git a/go.sum b/go.sum
index c230fa482..6871a11cd 100644
--- a/go.sum
+++ b/go.sum
@@ -241,8 +241,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/oras-project/oras-go/v3 v3.0.3-dev h1:1tpitwyCDXMai5TfI/tJEOtBl2Av6fAu5CvGfpq2Xj4=
-github.com/oras-project/oras-go/v3 v3.0.3-dev/go.mod h1:8eV2J5RW//YjOcI7SZKhqz2o0ivP3300wBB6Fgf2CIY=
+github.com/oras-project/oras-go/v3 v3.0.0-rc.1 h1:x/wMknvHZN/vQyMkW9d/znEXKGaPdxl8S27h2vuCq/Q=
+github.com/oras-project/oras-go/v3 v3.0.0-rc.1/go.mod h1:8eV2J5RW//YjOcI7SZKhqz2o0ivP3300wBB6Fgf2CIY=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
diff --git a/pkg/registry/client.go b/pkg/registry/client.go
index 3954712e2..d3f77295f 100644
--- a/pkg/registry/client.go
+++ b/pkg/registry/client.go
@@ -36,6 +36,7 @@ import (
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/oras-project/oras-go/v3"
 	"github.com/oras-project/oras-go/v3/content/memory"
+	orasregistry "github.com/oras-project/oras-go/v3/registry"
 	"github.com/oras-project/oras-go/v3/registry/remote"
 	"github.com/oras-project/oras-go/v3/registry/remote/auth"
 	remoteconfig "github.com/oras-project/oras-go/v3/registry/remote/config"
@@ -230,7 +231,13 @@ func (c *Client) applyOverrides(props *properties.Registry) {
 func (c *Client) newRepository(ref string) (*remote.Repository, error) {
 	if c.customHTTPClient {
 		// Legacy path: use c.authorizer directly (preserves custom TLS transport).
-		repo, err := remote.NewRepository(ref)
+		// NewRepository rejects a reference carrying a tag or digest, so pass
+		// only the repository portion.
+		parsed, err := orasregistry.ParseReference(ref)
+		if err != nil {
+			return nil, err
+		}
+		repo, err := remote.NewRepository(parsed.Registry + "/" + parsed.Repository)
 		if err != nil {
 			return nil, err
 		}