diff --git a/Cargo.lock b/Cargo.lock
index 2768396..d8b89a4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -259,7 +259,7 @@ dependencies = [
  "find-msvc-tools",
  "jobserver",
  "libc",
- "shlex 2.0.1",
+ "shlex",
 ]
 
 [[package]]
@@ -320,14 +320,14 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97bf4965940c2382204c0ded6dd3dd48c0c4e872f1e76fb1bf94f45991a2cb6a"
+checksum = "db8b397918185f0161ff3d6fcaa9e4bfc09b8367caf6e1d4a2848e5477ed027b"
 dependencies = [
  "clap",
  "clap_lex",
  "is_executable",
- "shlex 1.3.0",
+ "shlex",
 ]
 
 [[package]]
@@ -438,7 +438,7 @@ dependencies = [
  "composefs-fuse",
  "composefs-oci",
  "libc",
- "oci-spec",
+ "oci-spec 0.10.0",
  "rustix",
  "serde",
  "serde_json",
@@ -456,7 +456,7 @@ dependencies = [
  "crc",
  "flate2",
  "jsonrpc-fdpass",
- "oci-spec",
+ "oci-spec 0.9.0",
  "rustix",
  "serde",
  "serde_json",
@@ -530,7 +530,7 @@ dependencies = [
  "cap-std-ext 5.1.2",
  "futures-util",
  "itertools",
- "oci-spec",
+ "oci-spec 0.9.0",
  "rustix",
  "semver",
  "serde",
@@ -1178,7 +1178,7 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "82cb6a9f675da968c63b6208c641b9dca58fc0133ae53375736b1767b0cab8bd"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1496,6 +1496,23 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "oci-spec"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3df6f876ad774d6a676f7e968f5c3edacc32f90e65fe680a8b686235396556fb"
+dependencies = [
+ "const_format",
+ "derive_builder",
+ "getset",
+ "regex",
+ "serde",
+ "serde_json",
+ "strum",
+ "strum_macros",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "ocidir"
 version = "0.7.2"
@@ -1508,7 +1525,7 @@ dependencies = [
  "chrono",
  "flate2",
  "hex",
- "oci-spec",
+ "oci-spec 0.9.0",
  "openssl",
  "serde",
  "serde_json",
@@ -1970,12 +1987,6 @@ dependencies = [
  "lazy_static",
 ]
 
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
 [[package]]
 name = "shlex"
 version = "2.0.1"
diff --git a/composefs-run/Cargo.toml b/composefs-run/Cargo.toml
index b89ac09..783f51c 100644
--- a/composefs-run/Cargo.toml
+++ b/composefs-run/Cargo.toml
@@ -16,7 +16,7 @@ clap_complete = { version = "4.5", default-features = false, features = ["unstab
 composefs = { workspace = true }
 composefs-fuse = { workspace = true }
 composefs-oci = { workspace = true }
-oci-spec = { version = "0.9", default-features = false, features = ["runtime"] }
+oci-spec = { version = "0.10", default-features = false, features = ["runtime"] }
 libc = { version = "0.2", default-features = false }
 rustix = { version = "1.0.0", default-features = false, features = ["fs", "process", "mount", "pipe"] }
 serde = { version = "1.0", default-features = false, features = ["derive"] }