diff --git a/MODULE.bazel b/MODULE.bazel
index ea112494d..310e8d432 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -1,6 +1,11 @@
 module(name = "constellation")
 
 bazel_dep(name = "aspect_bazel_lib", version = "2.7.8")
+
+bazel_lib = use_extension("@aspect_bazel_lib//lib:extensions.bzl", "toolchains")
+bazel_lib.yq()
+use_repo(bazel_lib, "yq_toolchains")
+
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "gazelle", version = "0.38.0")
 bazel_dep(name = "hermetic_cc_toolchain", version = "3.1.0")
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 6eac3c38d..9989e1ffa 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -129,7 +129,7 @@
     "@@aspect_bazel_lib~//lib:extensions.bzl%toolchains": {
       "general": {
         "bzlTransitiveDigest": "SK+5VjMKVX5gfuC//JqN+b1rWW3PNLeAEsqwiD3CAOA=",
-        "usagesDigest": "un2V6RGFYjsvM5ras99mEMrstkY0R2xhQv9URU0NcoU=",
+        "usagesDigest": "eNtXd1h5FcxLG/P9Z/5OyYQ9VN3CC1T5NJk/eKHf1oU=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},
diff --git a/WORKSPACE.bzlmod b/WORKSPACE.bzlmod
index 228e281b0..7461c0d0f 100644
--- a/WORKSPACE.bzlmod
+++ b/WORKSPACE.bzlmod
@@ -215,12 +215,9 @@ load("@rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")
 
 rules_oci_dependencies()
 
-load("@rules_oci//oci:repositories.bzl", "LATEST_CRANE_VERSION", "oci_register_toolchains")
+load("@rules_oci//oci:repositories.bzl", "oci_register_toolchains")
 
-oci_register_toolchains(
-    name = "oci",
-    crane_version = LATEST_CRANE_VERSION,
-)
+oci_register_toolchains(name = "oci")
 
 load("//bazel/toolchains:container_images.bzl", "containter_image_deps")
 
diff --git a/bazel/toolchains/0001-disable-Windows-support.patch b/bazel/toolchains/0001-disable-Windows-support.patch
new file mode 100644
index 000000000..1cb9c8340
--- /dev/null
+++ b/bazel/toolchains/0001-disable-Windows-support.patch
@@ -0,0 +1,75 @@
+From d10473f4ac89c23dcd8ea02488b28a649f4a9735 Mon Sep 17 00:00:00 2001
+From: Markus Rudy <webmaster@burgerdev.de>
+Date: Tue, 6 Aug 2024 11:33:29 +0200
+Subject: [PATCH] disable Windows support
+
+It's broken and we don't need it, see
+https://github.com/bazel-contrib/rules_oci/issues/420.
+---
+ oci/private/image.bzl |  9 ---------
+ oci/private/util.bzl  | 29 +----------------------------
+ 2 files changed, 1 insertion(+), 37 deletions(-)
+
+diff --git a/oci/private/image.bzl b/oci/private/image.bzl
+index e8a6ca5..434947c 100644
+--- a/oci/private/image.bzl
++++ b/oci/private/image.bzl
+@@ -226,15 +226,6 @@ def _oci_image_impl(ctx):
+ 
+     action_env = {}
+ 
+-    # Windows: Don't convert arguments like --entrypoint=/some/bin to --entrypoint=C:/msys64/some/bin
+-    if ctx.target_platform_has_constraint(ctx.attr._windows_constraint[platform_common.ConstraintValueInfo]):
+-        # See https://www.msys2.org/wiki/Porting/:
+-        # > Setting MSYS2_ARG_CONV_EXCL=* prevents any path transformation.
+-        action_env["MSYS2_ARG_CONV_EXCL"] = "*"
+-
+-        # This one is for Windows Git MSys
+-        action_env["MSYS_NO_PATHCONV"] = "1"
+-
+     ctx.actions.run(
+         inputs = depset(inputs, transitive = transitive_inputs),
+         arguments = [args],
+diff --git a/oci/private/util.bzl b/oci/private/util.bzl
+index 7c2a2c2..479ca7d 100644
+--- a/oci/private/util.bzl
++++ b/oci/private/util.bzl
+@@ -141,34 +141,7 @@ def _maybe_wrap_launcher_for_windows(ctx, bash_launcher):
+     - make sure the bash_launcher is in the inputs to the action
+     - @bazel_tools//tools/sh:toolchain_type should appear in the rules toolchains
+     """
+-    if not ctx.target_platform_has_constraint(ctx.attr._windows_constraint[platform_common.ConstraintValueInfo]):
+-        return bash_launcher
+-
+-    win_launcher = ctx.actions.declare_file("wrap_%s.bat" % ctx.label.name)
+-    ctx.actions.write(
+-        output = win_launcher,
+-        content = r"""@echo off
+-SETLOCAL ENABLEEXTENSIONS
+-SETLOCAL ENABLEDELAYEDEXPANSION
+-for %%a in ("{bash_bin}") do set "bash_bin_dir=%%~dpa"
+-set PATH=%bash_bin_dir%;%PATH%
+-set "parent_dir=%~dp0"
+-set "parent_dir=!parent_dir:\=/!"
+-set args=%*
+-rem Escape \ and * in args before passing it with double quote
+-if defined args (
+-  set args=!args:\=\\\\!
+-  set args=!args:"=\"!
+-)
+-"{bash_bin}" -c "%parent_dir%{launcher} !args!"
+-""".format(
+-            bash_bin = ctx.toolchains["@bazel_tools//tools/sh:toolchain_type"].path,
+-            launcher = paths.relativize(bash_launcher.path, win_launcher.dirname),
+-        ),
+-        is_executable = True,
+-    )
+-
+-    return win_launcher
++    return bash_launcher
+ 
+ def _file_exists(rctx, path):
+     result = rctx.execute(["stat", path])
+-- 
+2.46.0
+
diff --git a/bazel/toolchains/oci_deps.bzl b/bazel/toolchains/oci_deps.bzl
index 22f5cb148..d07e56c14 100644
--- a/bazel/toolchains/oci_deps.bzl
+++ b/bazel/toolchains/oci_deps.bzl
@@ -7,11 +7,13 @@ def oci_deps():
     # Remove this override once https://github.com/bazel-contrib/rules_oci/issues/420 is fixed.
     http_archive(
         name = "rules_oci",
-        strip_prefix = "rules_oci-c622bf79d269473d3d9bc33510e16cfd9a1142bc",
+        strip_prefix = "rules_oci-2.0.0-beta1",
         type = "tar.gz",
         urls = [
-            "https://cdn.confidential.cloud/constellation/cas/sha256/dca0cfa2a8eb4ab79c231617964fc821f6d1a3bb9d996358975a5ceee5b8d25f",
-            "https://github.com/bazel-contrib/rules_oci/archive/c622bf79d269473d3d9bc33510e16cfd9a1142bc.tar.gz",
+            "https://cdn.confidential.cloud/constellation/cas/sha256/f70f07f9d0d6c275d7ec7d3c7f236d9b552ba3205e8f37df9c1125031cf967cc",
+            "https://github.com/bazel-contrib/rules_oci/releases/download/v2.0.0-beta1/rules_oci-v2.0.0-beta1.tar.gz",
         ],
-        sha256 = "dca0cfa2a8eb4ab79c231617964fc821f6d1a3bb9d996358975a5ceee5b8d25f",
+        sha256 = "f70f07f9d0d6c275d7ec7d3c7f236d9b552ba3205e8f37df9c1125031cf967cc",
+        patches = ["//bazel/toolchains:0001-disable-Windows-support.patch"],
+        patch_args = ["-p1"],
     )