···442442 }
443443444444 // Create a new reference with identity/image format
445445- // Use the identity (or DID) as the namespace to ensure canonical format
446446- // This transforms: evan.jarrett.net/debian -> evan.jarrett.net/debian (keeps full path)
447447- canonicalName := fmt.Sprintf("%s/%s", identityStr, imageName)
445445+ // Use the resolved handle (not raw DID) to ensure the name is valid per OCI reference grammar.
446446+ // DIDs contain colons which are illegal in reference path components.
447447+ // This transforms: did-plc-abc123/myimage -> alice.bsky.social/myimage
448448+ canonicalName := fmt.Sprintf("%s/%s", handle, imageName)
448449 ref, err := reference.ParseNamed(canonicalName)
449450 if err != nil {
450451 return nil, fmt.Errorf("invalid image name %s: %w", imageName, err)