diff --git a/config/cache-artifacts.yaml b/config/cache-artifacts.yaml
index 98b595ba..3c2fbfe1 100644
--- a/config/cache-artifacts.yaml
+++ b/config/cache-artifacts.yaml
@@ -34,11 +34,11 @@ oci_registry:
   architecture: amd64
   build_profile: minimal
   storage_driver: filesystem
-  extensions_enabled: false
+  extensions_enabled: true
   binary:
-    name: zot-linux-amd64-minimal
-    url: https://github.com/project-zot/zot/releases/download/v2.1.20/zot-linux-amd64-minimal
-    sha256: 902ea958c4a59c0f5c4ac9fa2bbaad8716e80551bcaede7ab4ea998bf57190a6
+    name: zot-linux-amd64
+    url: https://github.com/project-zot/zot/releases/download/v2.1.20/zot-linux-amd64
+    sha256: a32e42d042d1f17b5b1317e55cc1a415a744c873dcd05c25c56b665478258bcb
   checksums:
     name: checksums.sha256.txt
     url: https://github.com/project-zot/zot/releases/download/v2.1.20/checksums.sha256.txt
@@ -55,7 +55,7 @@ oci_registry:
     build_mode: pie
     commit_description: v2.1.20-0-g3b5796d
     independent_builds: 2
-    output_sha256: 902ea958c4a59c0f5c4ac9fa2bbaad8716e80551bcaede7ab4ea998bf57190a6
+    output_sha256: a32e42d042d1f17b5b1317e55cc1a415a744c873dcd05c25c56b665478258bcb
     evidence_file: zot-v2.1.20-reproducibility.json
     evidence_sha256: 020b153ba1c150c751e6ee00d1efe9af81b90321587f228f1271cd7525293d57
   runtime_evidence:
diff --git a/internal/cachemanifest/validate.go b/internal/cachemanifest/validate.go
index 7fccf6c3..6864d55d 100644
--- a/internal/cachemanifest/validate.go
+++ b/internal/cachemanifest/validate.go
@@ -101,14 +101,18 @@ func validateOCI(add func(string, string), component OCIRegistry) {
 	if component.StorageDriver != "filesystem" {
 		add("oci_registry.storage_driver", "must be filesystem")
 	}
-	if component.ExtensionsEnabled {
-		add("oci_registry.extensions_enabled", "must be false")
+	// The registry was pinned to the minimal build while it only served the
+	// authenticated cache buckets. The dockerd registry mirror needs the sync
+	// extension, which ships in the full asset, so extensions are now part of
+	// the contract rather than forbidden by it.
+	if !component.ExtensionsEnabled {
+		add("oci_registry.extensions_enabled", "must be true: the docker mirror needs the sync extension")
 	}
 	validateReleaseAsset(add, "oci_registry.binary", repository, component.Version, component.Binary)
 	validateReleaseAsset(add, "oci_registry.checksums", repository, component.Version, component.Checksums)
 	validateReleaseAsset(add, "oci_registry.schema", repository, component.Version, component.Schema)
-	if component.Binary.Name != "zot-linux-amd64-minimal" {
-		add("oci_registry.binary.name", "must be the minimal linux/amd64 asset")
+	if component.Binary.Name != "zot-linux-amd64" {
+		add("oci_registry.binary.name", "must be the full linux/amd64 asset that carries the sync extension")
 	}
 	if component.Checksums.Name != "checksums.sha256.txt" {
 		add("oci_registry.checksums.name", "must be checksums.sha256.txt")