diff --git a/go.mod b/go.mod
index 6a4f8fb..bc1fbb4 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,6 @@ module github.com/mxab/nacp
 go 1.26.5
 
 require (
-	github.com/docker/docker v28.5.2+incompatible
 	github.com/docker/go-connections v0.8.1 // indirect
 	github.com/evanphx/json-patch v0.5.2
 	github.com/hashicorp/go-multierror v1.1.1
@@ -37,6 +36,7 @@ require (
 
 require (
 	github.com/moby/moby/api v1.55.0
+	github.com/moby/moby/client v0.5.1
 	github.com/open-policy-agent/opa v1.19.0
 )
 
@@ -103,14 +103,11 @@ require (
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/moby/client v0.5.1 // indirect
 	github.com/moby/patternmatcher v0.6.1 // indirect
-	github.com/moby/sys/atomicwriter v0.1.0 // indirect
 	github.com/moby/sys/sequential v0.7.0 // indirect
 	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
-	github.com/morikuni/aec v1.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/notaryproject/notation-plugin-framework-go v1.0.0 // indirect
 	github.com/notaryproject/tspclient-go v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index 272b31a..1d14e16 100644
--- a/go.sum
+++ b/go.sum
@@ -54,8 +54,6 @@ github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54 h1:SG7nF6SRlWhcT7c
 github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
-github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
 github.com/docker/go-connections v0.8.1/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -197,8 +195,6 @@ github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJ
 github.com/moby/moby/client v0.5.1/go.mod h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
 github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
-github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/sequential v0.7.0 h1:ASQNGNROJSuOO6LL6bPHbKvuZu6NU8P4ldPWk31zj/8=
 github.com/moby/sys/sequential v0.7.0/go.mod h1:NfSTAp6V3fw4tmkD62PEcOKeZKquXT8VKCkf7aVR79o=
 github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
@@ -207,8 +203,6 @@ github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
-github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ=
-github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/notaryproject/notation-core-go v1.3.0 h1:mWJaw1QBpBxpjLSiKOjzbZvB+xh2Abzk14FHWQ+9Kfs=
diff --git a/pkg/admissionctrl/notation/notation_test.go b/pkg/admissionctrl/notation/notation_test.go
index 5742e42..3432b44 100644
--- a/pkg/admissionctrl/notation/notation_test.go
+++ b/pkg/admissionctrl/notation/notation_test.go
@@ -19,11 +19,9 @@ import (
 	"github.com/moby/go-archive"
 	"github.com/moby/go-archive/compression"
 
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/image"
-	"github.com/docker/docker/client"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/network"
+	"github.com/moby/moby/client"
 
 	"github.com/notaryproject/notation-core-go/signature/cose"
 	"github.com/notaryproject/notation-core-go/testhelper"
@@ -31,7 +29,7 @@ import (
 	"github.com/notaryproject/notation-go/dir"
 	"github.com/notaryproject/notation-go/registry"
 
-	dockerRegistry "github.com/docker/docker/api/types/registry"
+	dockerRegistry "github.com/moby/moby/api/types/registry"
 	"github.com/notaryproject/notation-go/signer"
 	"github.com/notaryproject/notation-go/verifier/trustpolicy"
 	"github.com/notaryproject/notation-go/verifier/truststore"
@@ -327,7 +325,7 @@ func buildImage(t *testing.T, address string, creds *creds) string {
 
 	imageTag := baseImageTag + ":v1"
 
-	opts := types.ImageBuildOptions{
+	opts := client.ImageBuildOptions{
 		Dockerfile: "Dockerfile",
 		Tags:       []string{imageTag},
 
@@ -340,14 +338,14 @@ func buildImage(t *testing.T, address string, creds *creds) string {
 	}
 	defer func() {
 
-		items, err := cli.ImageRemove(ctx, imageTag, image.RemoveOptions{
+		res, err := cli.ImageRemove(ctx, imageTag, client.ImageRemoveOptions{
 			Force:         true,
 			PruneChildren: true,
 		})
 		if err != nil {
 			t.Fatal(err)
 		}
-		for _, item := range items {
+		for _, item := range res.Items {
 			fmt.Println(item)
 		}
 	}()
@@ -357,7 +355,7 @@ func buildImage(t *testing.T, address string, creds *creds) string {
 	if creds != nil {
 		auth = creds.credsJsonBase64()
 	}
-	pushRes, err := cli.ImagePush(ctx, imageTag, image.PushOptions{
+	pushRes, err := cli.ImagePush(ctx, imageTag, client.ImagePushOptions{
 		All:          true,
 		RegistryAuth: auth,
 	})
@@ -366,7 +364,7 @@ func buildImage(t *testing.T, address string, creds *creds) string {
 	}
 	drainDockerStream(t, pushRes)
 
-	insp, _, err := cli.ImageInspectWithRaw(ctx, imageTag)
+	insp, err := cli.ImageInspect(ctx, imageTag)
 	if err != nil {
 		t.Fatal(err)
 	}