diff --git a/Cargo.lock b/Cargo.lock
index f1aba1bab..0958e0ee6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -102,6 +102,21 @@ version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f"
 
+[[package]]
+name = "async-compression"
+version = "0.4.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddb939d66e4ae03cee6091612804ba446b12878410cfa17f785f4dd67d4014e8"
+dependencies = [
+ "flate2",
+ "futures-core",
+ "memchr",
+ "pin-project-lite",
+ "tokio",
+ "zstd",
+ "zstd-safe",
+]
+
 [[package]]
 name = "autocfg"
 version = "1.4.0"
@@ -525,7 +540,7 @@ checksum = "55b672471b4e9f9e95499ea597ff64941a309b2cdbffcc46f2cc5e2d971fd335"
 [[package]]
 name = "composefs"
 version = "0.3.0"
-source = "git+https://github.com/containers/composefs-rs?rev=d5455222f282200913902f29c66d5f625ca5661f#d5455222f282200913902f29c66d5f625ca5661f"
+source = "git+https://github.com/containers/composefs-rs?rev=28d4721f77f973f0e394d60d6a69d9b39cb38d7f#28d4721f77f973f0e394d60d6a69d9b39cb38d7f"
 dependencies = [
  "anyhow",
  "hex",
@@ -542,6 +557,37 @@ dependencies = [
  "zstd",
 ]
 
+[[package]]
+name = "composefs-boot"
+version = "0.3.0"
+source = "git+https://github.com/containers/composefs-rs?rev=28d4721f77f973f0e394d60d6a69d9b39cb38d7f#28d4721f77f973f0e394d60d6a69d9b39cb38d7f"
+dependencies = [
+ "anyhow",
+ "composefs",
+ "hex",
+ "regex-automata 0.4.9",
+ "thiserror 2.0.12",
+ "zerocopy 0.8.23",
+]
+
+[[package]]
+name = "composefs-oci"
+version = "0.3.0"
+source = "git+https://github.com/containers/composefs-rs?rev=28d4721f77f973f0e394d60d6a69d9b39cb38d7f#28d4721f77f973f0e394d60d6a69d9b39cb38d7f"
+dependencies = [
+ "anyhow",
+ "async-compression",
+ "composefs",
+ "containers-image-proxy",
+ "hex",
+ "indicatif",
+ "oci-spec",
+ "rustix 1.0.3",
+ "sha2",
+ "tar",
+ "tokio",
+]
+
 [[package]]
 name = "console"
 version = "0.15.8"
@@ -1247,6 +1293,7 @@ dependencies = [
  "console",
  "number_prefix",
  "portable-atomic",
+ "tokio",
  "unicode-width 0.2.0",
  "web-time",
 ]
@@ -1727,6 +1774,8 @@ dependencies = [
  "clap_mangen",
  "comfy-table",
  "composefs",
+ "composefs-boot",
+ "composefs-oci",
  "containers-image-proxy",
  "flate2",
  "fn-error-context",
diff --git a/crates/lib/src/cli.rs b/crates/lib/src/cli.rs
index d6c676444..c87019007 100644
--- a/crates/lib/src/cli.rs
+++ b/crates/lib/src/cli.rs
@@ -1227,7 +1227,7 @@ async fn run_from_opt(opt: Opt) -> Result<()> {
                 FsverityOpts::Enable { path } => {
                     let fd =
                         std::fs::File::open(&path).with_context(|| format!("Reading {path}"))?;
-                    fsverity::enable_verity::<fsverity::Sha256HashValue>(&fd)?;
+                    fsverity::enable_verity_raw::<fsverity::Sha256HashValue>(&fd)?;
                     Ok(())
                 }
             },
diff --git a/crates/ostree-ext/Cargo.toml b/crates/ostree-ext/Cargo.toml
index 5c075c123..6b9cc5441 100644
--- a/crates/ostree-ext/Cargo.toml
+++ b/crates/ostree-ext/Cargo.toml
@@ -16,7 +16,9 @@ ostree = { features = ["v2025_2"], version = "0.20" }
 anyhow = { workspace = true }
 bootc-utils = { package = "bootc-internal-utils", path = "../utils", version = "0.0.0" }
 camino = { workspace = true, features = ["serde1"] }
-composefs = { git = "https://github.com/containers/composefs-rs", rev = "d5455222f282200913902f29c66d5f625ca5661f", features = ["rhel9"] }
+composefs = { git = "https://github.com/containers/composefs-rs", rev = "28d4721f77f973f0e394d60d6a69d9b39cb38d7f", package = "composefs", features = ["rhel9"] }
+composefs-boot = { git = "https://github.com/containers/composefs-rs", rev = "28d4721f77f973f0e394d60d6a69d9b39cb38d7f", package = "composefs-boot" }
+composefs-oci = { git = "https://github.com/containers/composefs-rs", rev = "28d4721f77f973f0e394d60d6a69d9b39cb38d7f", package = "composefs-oci" }
 chrono = { workspace = true }
 clap = { workspace = true, features = ["derive","cargo"] }
 clap_mangen = { workspace = true, optional = true }
diff --git a/crates/ostree-ext/src/fsverity.rs b/crates/ostree-ext/src/fsverity.rs
index 0e06b077f..f11804b05 100644
--- a/crates/ostree-ext/src/fsverity.rs
+++ b/crates/ostree-ext/src/fsverity.rs
@@ -65,7 +65,7 @@ fn enable_fsverity_in_objdir(d: &Dir) -> anyhow::Result<()> {
         let enabled =
             composefs::fsverity::measure_verity_opt::<Sha256HashValue>(f.as_fd())?.is_some();
         if !enabled {
-            composefs_fsverity::enable_verity::<Sha256HashValue>(&f)?;
+            composefs_fsverity::enable_verity_raw::<Sha256HashValue>(&f)?;
         }
     }
     Ok(())
@@ -123,7 +123,7 @@ pub async fn ensure_verity(repo: &ostree::Repo) -> Result<()> {
     // And finally, enable fsverity as a flag that we have successfully
     // enabled fsverity on all objects.
     let f = repodir.open(CONFIG_PATH)?;
-    match composefs_fsverity::enable_verity::<Sha256HashValue>(f.as_fd()) {
+    match composefs_fsverity::enable_verity_raw::<Sha256HashValue>(f.as_fd()) {
         Ok(()) => Ok(()),
         Err(composefs_fsverity::EnableVerityError::AlreadyEnabled) => Ok(()),
         Err(e) => Err(e.into()),