diff --git a/go.mod b/go.mod
index c0baece12..49e70194b 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/mudler/yip v0.0.0-20211129144714-088f39125cf7
 	github.com/pkg/errors v0.9.1
 	github.com/rancher/mapper v0.0.0-20190814232720-058a8b7feb99
-	github.com/rancher/wharfie v0.6.2
+	github.com/rancher/wharfie v0.6.5
 	github.com/sirupsen/logrus v1.9.2
 	github.com/stretchr/testify v1.8.1
 	github.com/tredoe/osutil v1.3.6
@@ -28,8 +28,8 @@ require (
 	github.com/coreos/yaml v0.0.0-20141224210557-6b16a5714269 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/cli v20.10.20+incompatible // indirect
-	github.com/docker/distribution v2.8.1+incompatible // indirect
-	github.com/docker/docker v20.10.20+incompatible // indirect
+	github.com/docker/distribution v2.8.2+incompatible // indirect
+	github.com/docker/docker v20.10.27+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
diff --git a/go.sum b/go.sum
index 809dfab38..d328d2e01 100644
--- a/go.sum
+++ b/go.sum
@@ -157,11 +157,11 @@ github.com/diskfs/go-diskfs v1.1.1/go.mod h1:afUPxxu+x1snp4aCY2bKR0CoZ/YFJewV3X2
 github.com/docker/cli v20.10.20+incompatible h1:lWQbHSHUFs7KraSN2jOJK7zbMS2jNCHI4mt4xUFUVQ4=
 github.com/docker/cli v20.10.20+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.8.1+incompatible h1:Q50tZOPR6T/hjNsyc9g8/syEs6bk8XXApsHjKukMl68=
-github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
+github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v17.12.0-ce-rc1.0.20200417035958-130b0bc6032c+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.20+incompatible h1:kH9tx6XO+359d+iAkumyKDc5Q1kOwPuAUaeri48nD6E=
-github.com/docker/docker v20.10.20+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v20.10.27+incompatible h1:Id/ZooynV4ZlD6xX20RCd3SR0Ikn7r4QZDa2ECK2TgA=
+github.com/docker/docker v20.10.27+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
@@ -592,8 +592,8 @@ github.com/rancher/dynamiclistener v0.3.5 h1:5TaIHvkDGmZKvc96Huur16zfTKOiLhDtK4S
 github.com/rancher/lasso v0.0.0-20221227210133-6ea88ca2fbcc/go.mod h1:dEfC9eFQigj95lv/JQ8K5e7+qQCacWs1aIA6nLxKzT8=
 github.com/rancher/mapper v0.0.0-20190814232720-058a8b7feb99 h1:rGnt9h1Uk7Yw4qNPyGq0LWHGdPyag/+Fg/wJWSTkKx4=
 github.com/rancher/mapper v0.0.0-20190814232720-058a8b7feb99/go.mod h1:zU4cm21k7ZBFVQhUu2aSH7NwouY317rLYxruOn+wdOQ=
-github.com/rancher/wharfie v0.6.2 h1:ZTrZ0suU0abWwLLf2zaqjhwpxK8+BkbnMocnU2u1bSQ=
-github.com/rancher/wharfie v0.6.2/go.mod h1:7ii0+eehBwUEFaJMiRHWCbvN11bsfVHT1oc+P/6IBSg=
+github.com/rancher/wharfie v0.6.5 h1:Xxj/ki8d4BFeQBvyViW9jX8BqxaPlZwXvRD8BG2Mm/8=
+github.com/rancher/wharfie v0.6.5/go.mod h1:iGXn5Y9GEhsx1h/lPUXAklK4DoY4+6NOJF+Li1j248Y=
 github.com/rancher/wrangler v1.1.1 h1:wmqUwqc2M7ADfXnBCJTFkTB5ZREWpD78rnZMzmxwMvM=
 github.com/rancher/wrangler v1.1.1/go.mod h1:ioVbKupzcBOdzsl55MvEDN0R1wdGggj8iNCYGFI5JvM=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
diff --git a/package/harvester-os/Dockerfile b/package/harvester-os/Dockerfile
index 9679e59e4..0c62a1e83 100644
--- a/package/harvester-os/Dockerfile
+++ b/package/harvester-os/Dockerfile
@@ -1,7 +1,7 @@
 ARG BASE_OS_IMAGE
 FROM ${BASE_OS_IMAGE}
 
-RUN curl -sfL https://github.com/rancher/wharfie/releases/download/v0.6.3/wharfie-amd64  -o /usr/bin/wharfie && chmod +x /usr/bin/wharfie
+RUN curl -sfL https://github.com/rancher/wharfie/releases/download/v0.6.5/wharfie-amd64  -o /usr/bin/wharfie && chmod +x /usr/bin/wharfie
 
 COPY files/ /
 RUN chmod 0600 /system/oem/*
diff --git a/vendor/github.com/rancher/wharfie/pkg/registries/endpoint.go b/vendor/github.com/rancher/wharfie/pkg/registries/endpoint.go
index 62d7118ef..c74b62c44 100644
--- a/vendor/github.com/rancher/wharfie/pkg/registries/endpoint.go
+++ b/vendor/github.com/rancher/wharfie/pkg/registries/endpoint.go
@@ -13,6 +13,11 @@ import (
 var _ authn.Keychain = &endpoint{}
 var _ http.RoundTripper = &endpoint{}
 
+const (
+	defaultRegistry     = "docker.io"
+	defaultRegistryHost = "index.docker.io"
+)
+
 type endpoint struct {
 	auth     authn.Authenticator
 	keychain authn.Keychain
@@ -69,10 +74,17 @@ func (e endpoint) RoundTrip(req *http.Request) (*http.Response, error) {
 			}
 		}
 
-		// override request host and scheme
+		// override request host and scheme; set ns from original host
+		q := req.URL.Query()
+		if req.Host == defaultRegistryHost {
+			q.Set("ns", defaultRegistry)
+		} else {
+			q.Set("ns", req.Host)
+		}
 		req.Host = endpointURL.Host
 		req.URL.Host = endpointURL.Host
 		req.URL.Scheme = endpointURL.Scheme
+		req.URL.RawQuery = q.Encode()
 	}
 
 	if newURL := req.URL.String(); originalURL != newURL {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 7893544bf..afba84653 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -13,10 +13,10 @@ github.com/docker/cli/cli/config
 github.com/docker/cli/cli/config/configfile
 github.com/docker/cli/cli/config/credentials
 github.com/docker/cli/cli/config/types
-# github.com/docker/distribution v2.8.1+incompatible
+# github.com/docker/distribution v2.8.2+incompatible
 ## explicit
 github.com/docker/distribution/registry/client/auth/challenge
-# github.com/docker/docker v20.10.20+incompatible
+# github.com/docker/docker v20.10.27+incompatible
 ## explicit
 github.com/docker/docker/pkg/homedir
 # github.com/docker/docker-credential-helpers v0.7.0
@@ -140,8 +140,8 @@ github.com/rancher/mapper/convert
 github.com/rancher/mapper/definition
 github.com/rancher/mapper/mappers
 github.com/rancher/mapper/values
-# github.com/rancher/wharfie v0.6.2
-## explicit; go 1.19
+# github.com/rancher/wharfie v0.6.5
+## explicit; go 1.20
 github.com/rancher/wharfie/pkg/registries
 # github.com/rancher/wrangler v0.0.0-20190426050201-5946f0eaed19 => github.com/rancher/wrangler v1.1.1
 ## explicit; go 1.19