diff --git a/internal/oci/resolver.go b/internal/oci/resolver.go
index 0f44f947006..94d31421ea0 100644
--- a/internal/oci/resolver.go
+++ b/internal/oci/resolver.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"io"
 	"net/url"
+	"os"
 	"strings"
 
 	"github.com/containerd/containerd/v2/core/remotes"
@@ -50,6 +51,11 @@ func NewResolver(config *configfile.ConfigFile) remotes.Resolver {
 					return auth.Username, auth.Password, nil
 				}),
 			)),
+			docker.WithPlainHTTP(func(s string) (bool, error) {
+				// Used for testing **only**
+				_, b := os.LookupEnv("__TEST__INSECURE__REGISTRY__")
+				return b, nil
+			}),
 		),
 	})
 }
diff --git a/pkg/e2e/fixtures/publish/oci/compose-override.yaml b/pkg/e2e/fixtures/publish/oci/compose-override.yaml
new file mode 100644
index 00000000000..c8947e610a8
--- /dev/null
+++ b/pkg/e2e/fixtures/publish/oci/compose-override.yaml
@@ -0,0 +1,3 @@
+services:
+  app:
+    env_file: test.env
\ No newline at end of file
diff --git a/pkg/e2e/fixtures/publish/oci/compose.yaml b/pkg/e2e/fixtures/publish/oci/compose.yaml
new file mode 100644
index 00000000000..369094bec14
--- /dev/null
+++ b/pkg/e2e/fixtures/publish/oci/compose.yaml
@@ -0,0 +1,5 @@
+services:
+  app:
+    extends:
+      file: extends.yaml
+      service: test
\ No newline at end of file
diff --git a/pkg/e2e/fixtures/publish/oci/extends.yaml b/pkg/e2e/fixtures/publish/oci/extends.yaml
new file mode 100644
index 00000000000..9184173d087
--- /dev/null
+++ b/pkg/e2e/fixtures/publish/oci/extends.yaml
@@ -0,0 +1,3 @@
+services:
+  test:
+    image: alpine
\ No newline at end of file
diff --git a/pkg/e2e/fixtures/publish/oci/test.env b/pkg/e2e/fixtures/publish/oci/test.env
new file mode 100644
index 00000000000..6e1f61b59ea
--- /dev/null
+++ b/pkg/e2e/fixtures/publish/oci/test.env
@@ -0,0 +1 @@
+HELLO=WORLD
\ No newline at end of file
diff --git a/pkg/e2e/publish_test.go b/pkg/e2e/publish_test.go
index 5b768d45c9e..33413d528d9 100644
--- a/pkg/e2e/publish_test.go
+++ b/pkg/e2e/publish_test.go
@@ -17,6 +17,7 @@
 package e2e
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 
@@ -173,3 +174,43 @@ FOO=bar`), out)
 		assert.Assert(t, strings.Contains(output, "Private Key\n\"\": -----BEGIN DSA PRIVATE KEY-----\nwxyz+ABC=\n-----END DSA PRIVATE KEY-----"), output)
 	})
 }
+
+func TestPublish(t *testing.T) {
+	c := NewParallelCLI(t)
+	const projectName = "compose-e2e-publish"
+	const registryName = projectName + "-registry"
+	c.RunDockerCmd(t, "run", "--name", registryName, "-P", "-d", "registry:3")
+	port := c.RunDockerCmd(t, "inspect", "--format", `{{ (index (index .NetworkSettings.Ports "5000/tcp") 0).HostPort }}`, registryName).Stdout()
+	registry := "localhost:" + strings.TrimSpace(port)
+	t.Cleanup(func() {
+		c.RunDockerCmd(t, "rm", "--force", registryName)
+	})
+
+	cmd := c.NewDockerComposeCmd(t, "-f", "./fixtures/publish/oci/compose.yaml", "-f", "./fixtures/publish/oci/compose-override.yaml",
+		"-p", projectName, "publish", "--with-env", "--yes", registry+"/test:test")
+	icmd.RunCmd(cmd, func(cmd *icmd.Cmd) {
+		cmd.Env = append(cmd.Env, "__TEST__INSECURE__REGISTRY__=true")
+	}).Assert(t, icmd.Expected{ExitCode: 0})
+
+	// docker exec -it compose-e2e-publish-registry tree /var/lib/registry/docker/registry/v2/
+
+	cmd = c.NewDockerComposeCmd(t, "--verbose", "--project-name=oci", "-f", fmt.Sprintf("oci://%s/test:test", registry), "config")
+	res := icmd.RunCmd(cmd, func(cmd *icmd.Cmd) {
+		cmd.Env = append(cmd.Env,
+			"XDG_CACHE_HOME="+t.TempDir(),
+			"__TEST__INSECURE__REGISTRY__=true")
+	})
+	res.Assert(t, icmd.Expected{ExitCode: 0})
+	assert.Equal(t, res.Stdout(), `name: oci
+services:
+  app:
+    environment:
+      HELLO: WORLD
+    image: alpine
+    networks:
+      default: null
+networks:
+  default:
+    name: oci_default
+`)
+}
diff --git a/pkg/remote/oci.go b/pkg/remote/oci.go
index d26742dfa27..1055993da91 100644
--- a/pkg/remote/oci.go
+++ b/pkg/remote/oci.go
@@ -223,7 +223,7 @@ func writeComposeFile(layer spec.Descriptor, i int, local string, content []byte
 			return err
 		}
 	}
-	f, err := os.Create(filepath.Join(local, file))
+	f, err := os.OpenFile(filepath.Join(local, file), os.O_RDWR|os.O_CREATE|os.O_APPEND, 0o600)
 	if err != nil {
 		return err
 	}