diff --git a/go.mod b/go.mod
index c6d3780d..2c97fa79 100644
--- a/go.mod
+++ b/go.mod
@@ -25,7 +25,7 @@ require (
 	github.com/goccy/go-yaml v1.19.2
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-containerregistry v0.21.8
+	github.com/google/go-containerregistry v0.21.9
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3
diff --git a/go.sum b/go.sum
index a6d32e26..a00acb78 100644
--- a/go.sum
+++ b/go.sum
@@ -185,6 +185,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.21.8 h1:Ig/zIsnztdCUNaiNNczE+MoP5xcyUMfvpvfOr1xyMLE=
 github.com/google/go-containerregistry v0.21.8/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo=
+github.com/google/go-containerregistry v0.21.9 h1:F+D4uZ3iA3DLMJLfhaqMdHJbzeqm/216WGQq2dokuLs=
+github.com/google/go-containerregistry v0.21.9/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY=
 github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U=
diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go
index 55281c86..596c78cb 100644
--- a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go
+++ b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go
@@ -437,7 +437,7 @@ func inWhiteoutDir(fileMap map[string]bool, file string) bool {
 
 func unsafeArchivePath(name string) bool {
 	clean := cleanArchivePath(name)
-	if clean == "." || clean == ".." || strings.HasPrefix(clean, "../") {
+	if clean == ".." || strings.HasPrefix(clean, "../") {
 		return true
 	}
 	if strings.HasPrefix(name, "\\") {
diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go
index b4395c23..ac879a67 100644
--- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go
+++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go
@@ -68,5 +68,5 @@ func (w *writer) cancelUpload(loc string) {
 	if err != nil {
 		return
 	}
-	_, _ = w.client.Do(req)
+	_, _ = w.getClient().Do(req)
 }
diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go
index 5675c97c..3a1d16f5 100644
--- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go
+++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go
@@ -410,7 +410,7 @@ func (rw *repoWriter) writeChild(ctx context.Context, child partial.Describable,
 func (rw *repoWriter) manifestExists(ctx context.Context, ref name.Reference, t Taggable) (bool, error) {
 	f := &fetcher{
 		target: ref.Context(),
-		client: rw.w.client,
+		client: rw.w.getClient(),
 	}
 
 	m, err := taggableToManifest(t)
diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go
index 84211482..01e9c767 100644
--- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go
+++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go
@@ -69,6 +69,13 @@ type writer struct {
 	scopes   []string
 }
 
+// getClient returns the HTTP client, blocking on scope updates.
+func (w *writer) getClient() *http.Client {
+	w.scopeLock.Lock()
+	defer w.scopeLock.Unlock()
+	return w.client
+}
+
 // makeDeleteClient returns an HTTP client whose token includes the "delete"
 // action so that registries requiring an explicit delete permission grant
 // access for manifest deletion.
@@ -208,7 +215,7 @@ func (w *writer) checkExistingBlob(ctx context.Context, h v1.Hash) (bool, error)
 		return false, err
 	}
 
-	resp, err := w.client.Do(req.WithContext(ctx))
+	resp, err := w.getClient().Do(req.WithContext(ctx))
 	if err != nil {
 		return false, err
 	}
@@ -246,7 +253,7 @@ func (w *writer) initiateUpload(ctx context.Context, from, mount, origin string)
 		return "", false, err
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := w.client.Do(req.WithContext(ctx))
+	resp, err := w.getClient().Do(req.WithContext(ctx))
 	if err != nil {
 		if from != "" {
 			// https://github.com/google/go-containerregistry/issues/1679
@@ -326,7 +333,7 @@ func (w *writer) streamBlob(ctx context.Context, layer v1.Layer, streamLocation
 	}
 	req.Header.Set("Content-Type", "application/octet-stream")
 
-	resp, err := w.client.Do(req.WithContext(ctx))
+	resp, err := w.getClient().Do(req.WithContext(ctx))
 	if err != nil {
 		return "", err
 	}
@@ -358,7 +365,7 @@ func (w *writer) commitBlob(ctx context.Context, location, digest string) error
 	}
 	req.Header.Set("Content-Type", "application/octet-stream")
 
-	resp, err := w.client.Do(req.WithContext(ctx))
+	resp, err := w.getClient().Do(req.WithContext(ctx))
 	if err != nil {
 		return err
 	}
@@ -517,7 +524,7 @@ func (w *writer) commitSubjectReferrers(ctx context.Context, sub name.Digest, ad
 		return err
 	}
 	req.Header.Set("Accept", string(types.OCIImageIndex))
-	resp, err := w.client.Do(req.WithContext(ctx))
+	resp, err := w.getClient().Do(req.WithContext(ctx))
 	if err != nil {
 		return err
 	}
@@ -543,7 +550,7 @@ func (w *writer) commitSubjectReferrers(ctx context.Context, sub name.Digest, ad
 		return err
 	}
 	req.Header.Set("Accept", string(types.OCIImageIndex))
-	resp, err = w.client.Do(req.WithContext(ctx))
+	resp, err = w.getClient().Do(req.WithContext(ctx))
 	if err != nil {
 		return err
 	}
@@ -630,7 +637,7 @@ func (w *writer) commitManifest(ctx context.Context, t Taggable, ref name.Refere
 		}
 		req.Header.Set("Content-Type", string(desc.MediaType))
 
-		resp, err := w.client.Do(req.WithContext(ctx))
+		resp, err := w.getClient().Do(req.WithContext(ctx))
 		if err != nil {
 			return err
 		}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 47db89d2..6390fd2d 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -436,7 +436,7 @@ github.com/google/go-cmp/cmp/internal/diff
 github.com/google/go-cmp/cmp/internal/flags
 github.com/google/go-cmp/cmp/internal/function
 github.com/google/go-cmp/cmp/internal/value
-# github.com/google/go-containerregistry v0.21.8
+# github.com/google/go-containerregistry v0.21.9
 ## explicit; go 1.25.0
 github.com/google/go-containerregistry/internal/and
 github.com/google/go-containerregistry/internal/compression