diff --git a/Cargo.lock b/Cargo.lock
index e39fb5b46..c1aa490bd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -232,8 +232,8 @@ dependencies = [
  "anyhow",
  "bootc-kernel-cmdline",
  "cap-std-ext 5.1.2",
- "cfsctl",
  "clap",
+ "composefs-ctl",
  "fn-error-context",
  "libc",
  "rustix",
@@ -328,12 +328,12 @@ dependencies = [
  "canon-json",
  "cap-std-ext 5.1.2",
  "cfg-if",
- "cfsctl",
  "chrono",
  "clap",
  "clap_complete",
  "clap_mangen",
  "comfy-table",
+ "composefs-ctl",
  "etc-merge",
  "fn-error-context",
  "futures-util",
@@ -631,28 +631,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "cfsctl"
-version = "0.3.0"
-source = "git+https://github.com/composefs/composefs-rs?rev=54d248f7a7#54d248f7a77d60d168a46dfacda8cad3e955af9d"
-dependencies = [
- "anyhow",
- "clap",
- "comfy-table",
- "composefs",
- "composefs-boot",
- "composefs-oci",
- "cstorage",
- "env_logger",
- "fn-error-context",
- "hex",
- "indicatif 0.17.11",
- "rustix",
- "serde",
- "serde_json",
- "tokio",
-]
-
 [[package]]
 name = "chacha20"
 version = "0.10.0"
@@ -790,8 +768,8 @@ checksum = "55b672471b4e9f9e95499ea597ff64941a309b2cdbffcc46f2cc5e2d971fd335"
 
 [[package]]
 name = "composefs"
-version = "0.3.0"
-source = "git+https://github.com/composefs/composefs-rs?rev=54d248f7a7#54d248f7a77d60d168a46dfacda8cad3e955af9d"
+version = "0.4.0"
+source = "git+https://github.com/composefs/composefs-rs?rev=4dd43a107e#4dd43a107ecfff3a2b8a816a2f9c4ea429f51c44"
 dependencies = [
  "anyhow",
  "composefs-ioctls",
@@ -815,8 +793,8 @@ dependencies = [
 
 [[package]]
 name = "composefs-boot"
-version = "0.3.0"
-source = "git+https://github.com/composefs/composefs-rs?rev=54d248f7a7#54d248f7a77d60d168a46dfacda8cad3e955af9d"
+version = "0.4.0"
+source = "git+https://github.com/composefs/composefs-rs?rev=4dd43a107e#4dd43a107ecfff3a2b8a816a2f9c4ea429f51c44"
 dependencies = [
  "anyhow",
  "composefs",
@@ -828,10 +806,32 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "composefs-ctl"
+version = "0.4.0"
+source = "git+https://github.com/composefs/composefs-rs?rev=4dd43a107e#4dd43a107ecfff3a2b8a816a2f9c4ea429f51c44"
+dependencies = [
+ "anyhow",
+ "clap",
+ "comfy-table",
+ "composefs",
+ "composefs-boot",
+ "composefs-oci",
+ "composefs-storage",
+ "env_logger",
+ "fn-error-context",
+ "hex",
+ "indicatif 0.17.11",
+ "rustix",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
 [[package]]
 name = "composefs-ioctls"
-version = "0.3.0"
-source = "git+https://github.com/composefs/composefs-rs?rev=54d248f7a7#54d248f7a77d60d168a46dfacda8cad3e955af9d"
+version = "0.4.0"
+source = "git+https://github.com/composefs/composefs-rs?rev=4dd43a107e#4dd43a107ecfff3a2b8a816a2f9c4ea429f51c44"
 dependencies = [
  "rustix",
  "thiserror 2.0.18",
@@ -839,20 +839,22 @@ dependencies = [
 
 [[package]]
 name = "composefs-oci"
-version = "0.3.0"
-source = "git+https://github.com/composefs/composefs-rs?rev=54d248f7a7#54d248f7a77d60d168a46dfacda8cad3e955af9d"
+version = "0.4.0"
+source = "git+https://github.com/composefs/composefs-rs?rev=4dd43a107e#4dd43a107ecfff3a2b8a816a2f9c4ea429f51c44"
 dependencies = [
  "anyhow",
  "async-compression",
  "base64 0.22.1",
  "bytes",
+ "cap-std-ext 5.1.2",
  "composefs",
  "composefs-boot",
+ "composefs-storage",
  "containers-image-proxy",
- "cstorage",
  "fn-error-context",
  "hex",
  "indicatif 0.18.4",
+ "ocidir",
  "rustix",
  "serde",
  "serde_json",
@@ -864,6 +866,31 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "composefs-storage"
+version = "0.4.0"
+source = "git+https://github.com/composefs/composefs-rs?rev=4dd43a107e#4dd43a107ecfff3a2b8a816a2f9c4ea429f51c44"
+dependencies = [
+ "anyhow",
+ "base64 0.22.1",
+ "cap-std 4.0.2",
+ "cap-std-ext 4.0.7",
+ "crc",
+ "flate2",
+ "jsonrpc-fdpass",
+ "oci-spec",
+ "rustix",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "tar-core",
+ "thiserror 2.0.18",
+ "tokio",
+ "toml 0.8.23",
+ "tracing",
+ "zstd",
+]
+
 [[package]]
 name = "compression-codecs"
 version = "0.4.38"
@@ -930,14 +957,14 @@ dependencies = [
 
 [[package]]
 name = "containers-image-proxy"
-version = "0.9.2"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4efbec7ca93c60462005402029839fcc8958eb5239bab1dd09f6d3e5165911a"
+checksum = "a00f7ac9ad66c570e37fcbf7644d678dcfabb50a4d8e85136ceb2fa45335597c"
 dependencies = [
- "cap-std-ext 4.0.7",
+ "cap-std-ext 5.1.2",
  "futures-util",
  "itertools",
- "oci-spec 0.8.4",
+ "oci-spec",
  "rustix",
  "semver",
  "serde",
@@ -1050,31 +1077,6 @@ dependencies = [
  "hybrid-array",
 ]
 
-[[package]]
-name = "cstorage"
-version = "0.3.0"
-source = "git+https://github.com/composefs/composefs-rs?rev=54d248f7a7#54d248f7a77d60d168a46dfacda8cad3e955af9d"
-dependencies = [
- "anyhow",
- "base64 0.22.1",
- "cap-std 4.0.2",
- "cap-std-ext 4.0.7",
- "crc",
- "flate2",
- "jsonrpc-fdpass",
- "oci-spec 0.8.4",
- "rustix",
- "serde",
- "serde_json",
- "sha2 0.10.9",
- "tar-core",
- "thiserror 2.0.18",
- "tokio",
- "toml 0.8.23",
- "tracing",
- "zstd",
-]
-
 [[package]]
 name = "darling"
 version = "0.20.11"
@@ -1284,7 +1286,7 @@ dependencies = [
  "anstream",
  "anyhow",
  "cap-std-ext 5.1.2",
- "cfsctl",
+ "composefs-ctl",
  "fn-error-context",
  "hex",
  "openssl",
@@ -2346,23 +2348,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "oci-spec"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc3da52b83ce3258fbf29f66ac784b279453c2ac3c22c5805371b921ede0d308"
-dependencies = [
- "const_format",
- "derive_builder",
- "getset",
- "regex",
- "serde",
- "serde_json",
- "strum",
- "strum_macros",
- "thiserror 2.0.18",
-]
-
 [[package]]
 name = "oci-spec"
 version = "0.9.0"
@@ -2382,9 +2367,9 @@ dependencies = [
 
 [[package]]
 name = "ocidir"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2559988a4497b6f6cb02c3066c008515b2d6d98234fb683e284235ef5141295"
+checksum = "bdb92f511503ca78a6b3c2a5415c49aa9bb03169d2715f67b1c0dc1654ed9636"
 dependencies = [
  "camino",
  "canon-json",
@@ -2392,7 +2377,7 @@ dependencies = [
  "chrono",
  "flate2",
  "hex",
- "oci-spec 0.8.4",
+ "oci-spec",
  "openssl",
  "serde",
  "serde_json",
@@ -2489,11 +2474,11 @@ dependencies = [
  "camino",
  "canon-json",
  "cap-std-ext 5.1.2",
- "cfsctl",
  "chrono",
  "clap",
  "clap_mangen",
  "comfy-table",
+ "composefs-ctl",
  "containers-image-proxy",
  "flate2",
  "fn-error-context",
@@ -3401,7 +3386,7 @@ dependencies = [
  "indicatif 0.18.4",
  "indoc",
  "libtest-mimic",
- "oci-spec 0.9.0",
+ "oci-spec",
  "rand 0.10.1",
  "rexpect",
  "rustix",
diff --git a/Cargo.toml b/Cargo.toml
index 3fa82ebcc..3851658e6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -42,9 +42,9 @@ clap = "4.5.4"
 clap_mangen = { version = "0.3.0" }
 # To develop against a local composefs-rs checkout, add a [patch] section at the end of this file:
 #   [patch."https://github.com/composefs/composefs-rs"]
-#   cfsctl = { path = "/path/to/composefs-rs/crates/cfsctl" }
+#   composefs-ctl = { path = "/path/to/composefs-rs/crates/composefs-ctl" }
 # The Justfile will auto-detect these and bind-mount them into container builds.
-cfsctl = { git = "https://github.com/composefs/composefs-rs", rev = "54d248f7a7", package = "cfsctl" }
+composefs-ctl = { git = "https://github.com/composefs/composefs-rs", rev = "4dd43a107e" }
 fn-error-context = "0.2.1"
 futures-util = "0.3"
 hex = "0.4.3"
diff --git a/crates/etc-merge/Cargo.toml b/crates/etc-merge/Cargo.toml
index 27129476e..ce698250e 100644
--- a/crates/etc-merge/Cargo.toml
+++ b/crates/etc-merge/Cargo.toml
@@ -12,7 +12,7 @@ rustix = { workspace = true }
 openssl = { workspace = true }
 hex = { workspace = true }
 tracing = { workspace = true }
-cfsctl = { workspace = true }
+composefs-ctl = { workspace = true }
 fn-error-context = { workspace = true }
 owo-colors = { workspace = true }
 anstream = { workspace = true }
diff --git a/crates/etc-merge/src/lib.rs b/crates/etc-merge/src/lib.rs
index f71ba158b..0743435a2 100644
--- a/crates/etc-merge/src/lib.rs
+++ b/crates/etc-merge/src/lib.rs
@@ -15,10 +15,10 @@ use anyhow::Context;
 use cap_std_ext::cap_std;
 use cap_std_ext::cap_std::fs::{Dir as CapStdDir, MetadataExt, Permissions, PermissionsExt};
 use cap_std_ext::dirext::CapStdExtDirExt;
-use cfsctl::composefs;
 use composefs::fsverity::{FsVerityHashValue, Sha256HashValue, Sha512HashValue};
 use composefs::generic_tree::{Directory, FileSystem, Inode, Leaf, LeafContent, LeafId, Stat};
 use composefs::tree::ImageError;
+use composefs_ctl::composefs;
 use rustix::fs::{
     AtFlags, Gid, Uid, XattrFlags, lgetxattr, llistxattr, lsetxattr, readlinkat, symlinkat,
 };
diff --git a/crates/initramfs/Cargo.toml b/crates/initramfs/Cargo.toml
index 32dbac6a0..204558d87 100644
--- a/crates/initramfs/Cargo.toml
+++ b/crates/initramfs/Cargo.toml
@@ -12,7 +12,7 @@ clap = { workspace = true, features = ["std", "help", "usage", "derive"] }
 libc.workspace = true
 rustix.workspace = true
 serde = { workspace = true, features = ["derive"] }
-cfsctl.workspace = true
+composefs-ctl.workspace = true
 toml.workspace = true
 fn-error-context.workspace = true
 bootc-kernel-cmdline =  { path = "../kernel_cmdline", version = "0.0.0" }
@@ -22,5 +22,5 @@ workspace = true
 
 [features]
 default = ['pre-6.15']
-rhel9 = ['cfsctl/rhel9']
-'pre-6.15' = ['cfsctl/pre-6.15']
+rhel9 = ['composefs-ctl/rhel9']
+'pre-6.15' = ['composefs-ctl/pre-6.15']
diff --git a/crates/initramfs/src/lib.rs b/crates/initramfs/src/lib.rs
index bb47bfd50..ca3412243 100644
--- a/crates/initramfs/src/lib.rs
+++ b/crates/initramfs/src/lib.rs
@@ -24,8 +24,6 @@ use rustix::{
 
 use serde::Deserialize;
 
-use cfsctl::composefs;
-use cfsctl::composefs_boot;
 use composefs::{
     fsverity::{FsVerityHashValue, Sha512HashValue},
     mount::FsHandle,
@@ -33,6 +31,8 @@ use composefs::{
     repository::Repository,
 };
 use composefs_boot::cmdline::get_cmdline_composefs;
+use composefs_ctl::composefs;
+use composefs_ctl::composefs_boot;
 
 use fn_error_context::context;
 
diff --git a/crates/lib/Cargo.toml b/crates/lib/Cargo.toml
index 712983810..b35a516ff 100644
--- a/crates/lib/Cargo.toml
+++ b/crates/lib/Cargo.toml
@@ -35,7 +35,7 @@ chrono = { workspace = true, features = ["serde"] }
 clap = { workspace = true, features = ["derive","cargo"] }
 clap_complete = "4"
 clap_mangen = { workspace = true, optional = true }
-cfsctl = { workspace = true }
+composefs-ctl = { workspace = true }
 fn-error-context = { workspace = true }
 futures-util = { workspace = true }
 hex = { workspace = true }
diff --git a/crates/lib/src/bootc_composefs/backwards_compat/bcompat_boot.rs b/crates/lib/src/bootc_composefs/backwards_compat/bcompat_boot.rs
index a27dbc7aa..f624bbead 100644
--- a/crates/lib/src/bootc_composefs/backwards_compat/bcompat_boot.rs
+++ b/crates/lib/src/bootc_composefs/backwards_compat/bcompat_boot.rs
@@ -23,7 +23,7 @@ use crate::{
 use anyhow::{Context, Result};
 use camino::Utf8PathBuf;
 use cap_std_ext::{cap_std::fs::Dir, dirext::CapStdExtDirExt};
-use cfsctl::composefs_boot::bootloader::{EFI_ADDON_DIR_EXT, EFI_EXT};
+use composefs_ctl::composefs_boot::bootloader::{EFI_ADDON_DIR_EXT, EFI_EXT};
 use fn_error_context::context;
 use ocidir::cap_std::ambient_authority;
 use rustix::fs::{RenameFlags, fsync, renameat_with};
diff --git a/crates/lib/src/bootc_composefs/boot.rs b/crates/lib/src/bootc_composefs/boot.rs
index faa5b9954..f64b2af5e 100644
--- a/crates/lib/src/bootc_composefs/boot.rs
+++ b/crates/lib/src/bootc_composefs/boot.rs
@@ -75,9 +75,6 @@ use cap_std_ext::{
     cap_std::{ambient_authority, fs::Dir},
     dirext::CapStdExtDirExt,
 };
-use cfsctl::composefs;
-use cfsctl::composefs_boot;
-use cfsctl::composefs_oci;
 use clap::ValueEnum;
 use composefs::fs::read_file;
 use composefs::fsverity::{FsVerityHashValue, Sha512HashValue};
@@ -87,6 +84,9 @@ use composefs_boot::bootloader::{
     UsrLibModulesVmlinuz, get_boot_resources,
 };
 use composefs_boot::{cmdline::get_cmdline_composefs, os_release::OsReleaseInfo, uki};
+use composefs_ctl::composefs;
+use composefs_ctl::composefs_boot;
+use composefs_ctl::composefs_oci;
 use fn_error_context::context;
 use rustix::{mount::MountFlags, path::Arg};
 use schemars::JsonSchema;
diff --git a/crates/lib/src/bootc_composefs/digest.rs b/crates/lib/src/bootc_composefs/digest.rs
index d5a6a3082..074423e25 100644
--- a/crates/lib/src/bootc_composefs/digest.rs
+++ b/crates/lib/src/bootc_composefs/digest.rs
@@ -9,11 +9,11 @@ use anyhow::{Context, Result};
 use camino::Utf8Path;
 use cap_std_ext::cap_std;
 use cap_std_ext::cap_std::fs::Dir;
-use cfsctl::composefs;
-use cfsctl::composefs_boot;
 use composefs::dumpfile;
 use composefs::fsverity::{Algorithm, FsVerityHashValue};
 use composefs_boot::BootOps as _;
+use composefs_ctl::composefs;
+use composefs_ctl::composefs_boot;
 use tempfile::TempDir;
 
 use crate::store::ComposefsRepository;
diff --git a/crates/lib/src/bootc_composefs/export.rs b/crates/lib/src/bootc_composefs/export.rs
index ea0c70272..ea760e603 100644
--- a/crates/lib/src/bootc_composefs/export.rs
+++ b/crates/lib/src/bootc_composefs/export.rs
@@ -2,9 +2,9 @@ use std::{fs::File, os::fd::AsRawFd};
 
 use anyhow::{Context, Result};
 use cap_std_ext::cap_std::{ambient_authority, fs::Dir};
-use cfsctl::composefs;
-use cfsctl::composefs_oci;
 use composefs::splitstream::SplitStreamData;
+use composefs_ctl::composefs;
+use composefs_ctl::composefs_oci;
 use composefs_oci::open_config;
 use ocidir::{OciDir, oci_spec::image::Platform};
 use ostree_ext::container::Transport;
diff --git a/crates/lib/src/bootc_composefs/finalize.rs b/crates/lib/src/bootc_composefs/finalize.rs
index 2cd7fbe69..ddc6d036f 100644
--- a/crates/lib/src/bootc_composefs/finalize.rs
+++ b/crates/lib/src/bootc_composefs/finalize.rs
@@ -11,8 +11,8 @@ use bootc_initramfs_setup::mount_composefs_image;
 use bootc_mount::tempmount::TempMount;
 use cap_std_ext::cap_std::{ambient_authority, fs::Dir};
 use cap_std_ext::dirext::CapStdExtDirExt;
-use cfsctl::composefs;
 use composefs::generic_tree::{FileSystem, Stat};
+use composefs_ctl::composefs;
 use etc_merge::{compute_diff, merge, print_diff, traverse_etc};
 use rustix::fs::fsync;
 
diff --git a/crates/lib/src/bootc_composefs/gc.rs b/crates/lib/src/bootc_composefs/gc.rs
index 6dab167e6..8ac54c010 100644
--- a/crates/lib/src/bootc_composefs/gc.rs
+++ b/crates/lib/src/bootc_composefs/gc.rs
@@ -6,12 +6,12 @@
 
 use anyhow::{Context, Result};
 use cap_std_ext::{cap_std::fs::Dir, dirext::CapStdExtDirExt};
-use cfsctl::composefs;
-use cfsctl::composefs_boot;
-use cfsctl::composefs_oci;
 use composefs::fsverity::FsVerityHashValue;
 use composefs::repository::GcResult;
 use composefs_boot::bootloader::EFI_EXT;
+use composefs_ctl::composefs;
+use composefs_ctl::composefs_boot;
+use composefs_ctl::composefs_oci;
 
 use crate::{
     bootc_composefs::{
diff --git a/crates/lib/src/bootc_composefs/repo.rs b/crates/lib/src/bootc_composefs/repo.rs
index 00f794364..1f59fb8d7 100644
--- a/crates/lib/src/bootc_composefs/repo.rs
+++ b/crates/lib/src/bootc_composefs/repo.rs
@@ -3,11 +3,11 @@ use std::sync::Arc;
 
 use anyhow::{Context, Result};
 
-use cfsctl::composefs;
-use cfsctl::composefs_boot;
-use cfsctl::composefs_oci;
 use composefs::fsverity::{FsVerityHashValue, Sha512HashValue};
 use composefs_boot::bootloader::{BootEntry as ComposefsBootEntry, get_boot_resources};
+use composefs_ctl::composefs;
+use composefs_ctl::composefs_boot;
+use composefs_ctl::composefs_oci;
 use composefs_oci::{
     LocalFetchOpt, PullOptions, PullResult,
     image::create_filesystem as create_composefs_filesystem, tag_image,
diff --git a/crates/lib/src/bootc_composefs/state.rs b/crates/lib/src/bootc_composefs/state.rs
index 1681f6adb..6c14f954b 100644
--- a/crates/lib/src/bootc_composefs/state.rs
+++ b/crates/lib/src/bootc_composefs/state.rs
@@ -13,8 +13,8 @@ use canon_json::CanonJsonSerialize;
 use cap_std_ext::cap_std::ambient_authority;
 use cap_std_ext::cap_std::fs::{Dir, Permissions, PermissionsExt};
 use cap_std_ext::dirext::CapStdExtDirExt;
-use cfsctl::composefs;
 use composefs::fsverity::{FsVerityHashValue, Sha512HashValue};
+use composefs_ctl::composefs;
 use fn_error_context::context;
 
 use ostree_ext::container::deploy::ORIGIN_CONTAINER;
diff --git a/crates/lib/src/bootc_composefs/status.rs b/crates/lib/src/bootc_composefs/status.rs
index a92d6ed1e..7e08fa115 100644
--- a/crates/lib/src/bootc_composefs/status.rs
+++ b/crates/lib/src/bootc_composefs/status.rs
@@ -3,8 +3,8 @@ use std::{collections::HashSet, io::Read, sync::OnceLock};
 use anyhow::{Context, Result};
 use bootc_kernel_cmdline::utf8::Cmdline;
 use bootc_mount::inspect_filesystem;
-use cfsctl::composefs::fsverity::Sha512HashValue;
-use cfsctl::composefs_oci;
+use composefs_ctl::composefs::fsverity::Sha512HashValue;
+use composefs_ctl::composefs_oci;
 use composefs_oci::OciImage;
 use fn_error_context::context;
 use serde::{Deserialize, Serialize};
diff --git a/crates/lib/src/bootc_composefs/update.rs b/crates/lib/src/bootc_composefs/update.rs
index 793ee06c7..0be2e430d 100644
--- a/crates/lib/src/bootc_composefs/update.rs
+++ b/crates/lib/src/bootc_composefs/update.rs
@@ -1,11 +1,11 @@
 use anyhow::{Context, Result};
 use camino::Utf8PathBuf;
 use cap_std_ext::{cap_std::fs::Dir, dirext::CapStdExtDirExt};
-use cfsctl::composefs;
-use cfsctl::composefs_boot;
-use cfsctl::composefs_oci;
 use composefs::fsverity::{FsVerityHashValue, Sha512HashValue};
 use composefs_boot::BootOps;
+use composefs_ctl::composefs;
+use composefs_ctl::composefs_boot;
+use composefs_ctl::composefs_oci;
 use composefs_oci::image::create_filesystem;
 use fn_error_context::context;
 use ocidir::cap_std::ambient_authority;
diff --git a/crates/lib/src/bootc_composefs/utils.rs b/crates/lib/src/bootc_composefs/utils.rs
index 6ae43210c..c85478d64 100644
--- a/crates/lib/src/bootc_composefs/utils.rs
+++ b/crates/lib/src/bootc_composefs/utils.rs
@@ -7,7 +7,7 @@ use crate::{
 };
 use anyhow::Result;
 use bootc_kernel_cmdline::utf8::Cmdline;
-use cfsctl::composefs_boot;
+use composefs_ctl::composefs_boot;
 use fn_error_context::context;
 
 fn get_uki(storage: &Storage, deployment_verity: &str) -> Result<Vec<u8>> {
diff --git a/crates/lib/src/cli.rs b/crates/lib/src/cli.rs
index 3255bb13d..48559f34d 100644
--- a/crates/lib/src/cli.rs
+++ b/crates/lib/src/cli.rs
@@ -13,15 +13,15 @@ use anyhow::{Context, Result, anyhow, ensure};
 use camino::{Utf8Path, Utf8PathBuf};
 use cap_std_ext::cap_std;
 use cap_std_ext::cap_std::fs::Dir;
-use cfsctl::composefs;
-use cfsctl::composefs_boot;
-use cfsctl::composefs_oci;
 use clap::CommandFactory;
 use clap::Parser;
 use clap::ValueEnum;
 use composefs::dumpfile;
 use composefs::fsverity;
 use composefs::fsverity::FsVerityHashValue;
+use composefs_ctl::composefs;
+use composefs_ctl::composefs_boot;
+use composefs_ctl::composefs_oci;
 
 use composefs_boot::BootOps as _;
 use etc_merge::{compute_diff, print_diff};
@@ -2083,7 +2083,7 @@ async fn run_from_opt(opt: Opt) -> Result<()> {
                     Ok(())
                 }
             },
-            InternalsOpts::Cfs { args } => cfsctl::run_from_iter(args.iter()).await,
+            InternalsOpts::Cfs { args } => composefs_ctl::run_from_iter(args.iter()).await,
             InternalsOpts::Reboot => crate::reboot::reboot(),
             InternalsOpts::Fsck => {
                 let storage = &get_storage().await?;
diff --git a/crates/lib/src/deploy.rs b/crates/lib/src/deploy.rs
index 1e5a93f99..c4c686eca 100644
--- a/crates/lib/src/deploy.rs
+++ b/crates/lib/src/deploy.rs
@@ -38,10 +38,9 @@ const BASE_IMAGE_PREFIX: &str = "ostree/container/baseimage/bootc";
 /// This allows registries to distinguish "image pulls for bootc client runs"
 /// from other skopeo/containers-image users.
 pub(crate) fn new_proxy_config() -> ostree_ext::containers_image_proxy::ImageProxyConfig {
-    ostree_ext::containers_image_proxy::ImageProxyConfig {
-        user_agent_prefix: Some(format!("bootc/{}", env!("CARGO_PKG_VERSION"))),
-        ..Default::default()
-    }
+    let mut c = ostree_ext::containers_image_proxy::ImageProxyConfig::default();
+    c.user_agent_prefix = Some(format!("bootc/{}", env!("CARGO_PKG_VERSION")));
+    c
 }
 
 /// Set on an ostree commit if this is a derived commit
diff --git a/crates/lib/src/fsck.rs b/crates/lib/src/fsck.rs
index f4921b050..25e95e33c 100644
--- a/crates/lib/src/fsck.rs
+++ b/crates/lib/src/fsck.rs
@@ -16,7 +16,7 @@ use camino::Utf8PathBuf;
 use cap_std::fs::{Dir, MetadataExt as _};
 use cap_std_ext::cap_std;
 use cap_std_ext::dirext::CapStdExtDirExt;
-use cfsctl::composefs;
+use composefs_ctl::composefs;
 use fn_error_context::context;
 use linkme::distributed_slice;
 use ostree_ext::ostree;
diff --git a/crates/lib/src/install.rs b/crates/lib/src/install.rs
index d36f47618..bceab5053 100644
--- a/crates/lib/src/install.rs
+++ b/crates/lib/src/install.rs
@@ -2016,7 +2016,7 @@ async fn install_to_filesystem_impl(
             let (cfs_repo, _created) = crate::store::ComposefsRepository::init_path(
                 &rootfs.physical_root,
                 crate::store::COMPOSEFS,
-                cfsctl::composefs::fsverity::Algorithm::SHA512,
+                composefs_ctl::composefs::fsverity::Algorithm::SHA512,
                 false,
             )?;
             crate::deploy::check_disk_space_composefs(
diff --git a/crates/lib/src/kernel.rs b/crates/lib/src/kernel.rs
index 4d07b747f..96cf97548 100644
--- a/crates/lib/src/kernel.rs
+++ b/crates/lib/src/kernel.rs
@@ -11,7 +11,7 @@ use bootc_kernel_cmdline::utf8::Cmdline;
 use camino::Utf8PathBuf;
 use cap_std_ext::cap_std::fs::Dir;
 use cap_std_ext::dirext::CapStdExtDirExt;
-use cfsctl::composefs_boot;
+use composefs_ctl::composefs_boot;
 use serde::Serialize;
 
 use crate::bootc_composefs::boot::EFI_LINUX;
diff --git a/crates/lib/src/parsers/bls_config.rs b/crates/lib/src/parsers/bls_config.rs
index d86bd508e..c72674a08 100644
--- a/crates/lib/src/parsers/bls_config.rs
+++ b/crates/lib/src/parsers/bls_config.rs
@@ -5,8 +5,8 @@
 use anyhow::{Result, anyhow};
 use bootc_kernel_cmdline::utf8::{Cmdline, CmdlineOwned};
 use camino::Utf8PathBuf;
-use cfsctl::composefs_boot;
 use composefs_boot::bootloader::EFI_EXT;
+use composefs_ctl::composefs_boot;
 use core::fmt;
 use std::collections::HashMap;
 use std::fmt::Display;
diff --git a/crates/lib/src/parsers/grub_menuconfig.rs b/crates/lib/src/parsers/grub_menuconfig.rs
index b01e87e54..a452d57c9 100644
--- a/crates/lib/src/parsers/grub_menuconfig.rs
+++ b/crates/lib/src/parsers/grub_menuconfig.rs
@@ -4,8 +4,8 @@ use std::fmt::Display;
 
 use anyhow::Result;
 use camino::Utf8PathBuf;
-use cfsctl::composefs_boot;
 use composefs_boot::bootloader::EFI_EXT;
+use composefs_ctl::composefs_boot;
 use nom::{
     Err, IResult, Parser,
     bytes::complete::{escaped, tag, take_until},
diff --git a/crates/lib/src/store/mod.rs b/crates/lib/src/store/mod.rs
index 78d2c0e74..940d59100 100644
--- a/crates/lib/src/store/mod.rs
+++ b/crates/lib/src/store/mod.rs
@@ -38,8 +38,8 @@ use ostree_ext::sysroot::SysrootLock;
 use ostree_ext::{gio, ostree};
 use rustix::fs::Mode;
 
-use cfsctl::composefs;
 use composefs::fsverity::Sha512HashValue;
+use composefs_ctl::composefs;
 
 use crate::bootc_composefs::backwards_compat::bcompat_boot::prepend_custom_prefix;
 use crate::bootc_composefs::boot::{EFI_LINUX, mount_esp};
diff --git a/crates/lib/src/testutils.rs b/crates/lib/src/testutils.rs
index a3ec5645f..3712c7e44 100644
--- a/crates/lib/src/testutils.rs
+++ b/crates/lib/src/testutils.rs
@@ -167,7 +167,7 @@ impl TestRoot {
         let (mut repo, _created) = ComposefsRepository::init_path(
             &repo_dir,
             ".",
-            cfsctl::composefs::fsverity::Algorithm::SHA512,
+            composefs_ctl::composefs::fsverity::Algorithm::SHA512,
             false,
         )
         .context("Initializing composefs repo")?;
diff --git a/crates/ostree-ext/Cargo.toml b/crates/ostree-ext/Cargo.toml
index 8bd302934..21fbab810 100644
--- a/crates/ostree-ext/Cargo.toml
+++ b/crates/ostree-ext/Cargo.toml
@@ -19,7 +19,7 @@ cap-std-ext = { workspace = true, features = ["fs_utf8"] }
 chrono = { workspace = true }
 clap = { workspace = true, features = ["derive","cargo"] }
 clap_mangen = { workspace = true, optional = true }
-cfsctl = { workspace = true }
+composefs-ctl = { workspace = true }
 fn-error-context = { workspace = true }
 hex = { workspace = true }
 indicatif = { workspace = true }
@@ -39,14 +39,14 @@ xshell = { workspace = true, optional = true }
 
 # Crate-specific dependencies
 comfy-table = "7.1.1"
-containers-image-proxy = "0.9.2"
+containers-image-proxy = "0.10.0"
 flate2 = { features = ["zlib"], default-features = false, version = "1.0.20" }
 futures-util = "0.3.13"
 gvariant = "0.5.0"
 indexmap = { version = "2.2.2", features = ["serde"] }
 io-lifetimes = "3"
 libsystemd = "0.7.0"
-ocidir = "0.7.0"
+ocidir = "0.7.2"
 # We re-export this library too.
 ostree = { features = ["v2025_3"], version = "0.20.5" }
 pin-project = "1.0"
diff --git a/crates/ostree-ext/src/cli.rs b/crates/ostree-ext/src/cli.rs
index a010cc336..39553e740 100644
--- a/crates/ostree-ext/src/cli.rs
+++ b/crates/ostree-ext/src/cli.rs
@@ -566,13 +566,12 @@ pub(crate) enum Opt {
 #[allow(clippy::from_over_into)]
 impl Into<ostree_container::store::ImageProxyConfig> for ContainerProxyOpts {
     fn into(self) -> ostree_container::store::ImageProxyConfig {
-        ostree_container::store::ImageProxyConfig {
-            auth_anonymous: self.auth_anonymous,
-            authfile: self.authfile,
-            certificate_directory: self.cert_dir,
-            insecure_skip_tls_verification: Some(self.insecure_skip_tls_verification),
-            ..Default::default()
-        }
+        let mut c = ostree_container::store::ImageProxyConfig::default();
+        c.auth_anonymous = self.auth_anonymous;
+        c.authfile = self.authfile;
+        c.certificate_directory = self.cert_dir;
+        c.insecure_skip_tls_verification = Some(self.insecure_skip_tls_verification);
+        c
     }
 }
 
diff --git a/crates/ostree-ext/src/container/mod.rs b/crates/ostree-ext/src/container/mod.rs
index 3550b6bf1..4b521690c 100644
--- a/crates/ostree-ext/src/container/mod.rs
+++ b/crates/ostree-ext/src/container/mod.rs
@@ -777,10 +777,8 @@ mod tests {
         assert!(c.skopeo_cmd.is_none());
 
         // Verify interaction with explicit isolation
-        let mut c = ImageProxyConfig {
-            skopeo_cmd: Some(Command::new("skopeo")),
-            ..Default::default()
-        };
+        let mut c = ImageProxyConfig::default();
+        c.skopeo_cmd = Some(Command::new("skopeo"));
         super::merge_default_container_proxy_opts_with_isolation(&mut c, Some("foo")).unwrap();
         assert_eq!(c.skopeo_cmd.unwrap().get_program(), "skopeo");
     }
diff --git a/crates/ostree-ext/src/fsverity.rs b/crates/ostree-ext/src/fsverity.rs
index 7a3658914..c168decdf 100644
--- a/crates/ostree-ext/src/fsverity.rs
+++ b/crates/ostree-ext/src/fsverity.rs
@@ -8,7 +8,7 @@ use std::str::FromStr;
 use anyhow::{Context, Result};
 use cap_std::fs::Dir;
 use cap_std_ext::cap_std;
-use cfsctl::composefs::fsverity as composefs_fsverity;
+use composefs_ctl::composefs::fsverity as composefs_fsverity;
 use composefs_fsverity::Sha256HashValue;
 use ostree::gio;
 
diff --git a/crates/ostree-ext/src/integrationtest.rs b/crates/ostree-ext/src/integrationtest.rs
index 34ac182c0..89b605d6c 100644
--- a/crates/ostree-ext/src/integrationtest.rs
+++ b/crates/ostree-ext/src/integrationtest.rs
@@ -138,10 +138,8 @@ fn test_proxy_auth() -> Result<()> {
     } else {
         assert_eq!(c.authfile.unwrap().as_path(), authpath,);
     }
-    let c = ImageProxyConfig {
-        auth_anonymous: true,
-        ..Default::default()
-    };
+    let mut c = ImageProxyConfig::default();
+    c.auth_anonymous = true;
     assert_eq!(c.authfile, None);
     std::fs::remove_file(authpath)?;
     let mut c = ImageProxyConfig::default();
diff --git a/crates/ostree-ext/src/lib.rs b/crates/ostree-ext/src/lib.rs
index e9757861e..1dd2a7f3f 100644
--- a/crates/ostree-ext/src/lib.rs
+++ b/crates/ostree-ext/src/lib.rs
@@ -24,9 +24,9 @@
 // Re-export our dependencies.  See https://gtk-rs.org/blog/2021/06/22/new-release.html
 // "Dependencies are re-exported".  Users will need e.g. `gio::File`, so this avoids
 // them needing to update matching versions.
-pub use cfsctl::composefs;
-pub use cfsctl::composefs_boot;
-pub use cfsctl::composefs_oci;
+pub use composefs_ctl::composefs;
+pub use composefs_ctl::composefs_boot;
+pub use composefs_ctl::composefs_oci;
 pub use containers_image_proxy;
 pub use containers_image_proxy::oci_spec;
 pub use ostree;
diff --git a/docs/Dockerfile.mdbook b/docs/Dockerfile.mdbook
index 2a1ac4ca2..55f90b697 100644
--- a/docs/Dockerfile.mdbook
+++ b/docs/Dockerfile.mdbook
@@ -23,7 +23,7 @@ set -xeuo pipefail
 # Build rustdoc for internal crates
 cargo doc --workspace --no-deps --document-private-items
 # Also build docs for key external git dependencies (not on docs.rs)
-cargo doc --no-deps --document-private-items -p cfsctl
+cargo doc --no-deps --document-private-items -p composefs-ctl
 # Build mdbook
 cd docs
 mdbook-mermaid install .
diff --git a/docs/src/internals.md b/docs/src/internals.md
index 8d80da88d..aa0f24d7a 100644
--- a/docs/src/internals.md
+++ b/docs/src/internals.md
@@ -117,4 +117,4 @@ The following rustdoc documentation is generated from the source code with
 
 These crates are pulled from git and are not published to crates.io (so not on docs.rs).
 
-- [cfsctl](internals/cfsctl/index.html) - composefs-rs entrypoint crate (re-exports composefs, composefs-boot, composefs-oci)
+- [composefs-ctl](internals/composefs_ctl/index.html) - composefs-rs entrypoint crate (re-exports composefs, composefs-boot, composefs-oci)