diff --git a/apicurio-registry.yaml b/apicurio-registry.yaml
index 1a5d9159b09..e80229af4c8 100644
--- a/apicurio-registry.yaml
+++ b/apicurio-registry.yaml
@@ -1,7 +1,7 @@
 package:
   name: apicurio-registry
   version: "3.1.6"
-  epoch: 1 # GHSA-cphf-4846-3xx9
+  epoch: 2
   description: An API/Schema registry - stores APIs and Schemas
   copyright:
     - license: Apache-2.0
@@ -10,6 +10,9 @@ package:
     memory: 64Gi
     disk: 200Gi
 
+vars:
+  java-version: '17'
+
 environment:
   contents:
     packages:
@@ -23,9 +26,9 @@ environment:
       - maven
       - nodejs-20
       - npm
-      - openjdk-17-default-jdk
+      - openjdk-${{vars.java-version}}-default-jdk
   environment:
-    JAVA_HOME: /usr/lib/jvm/java-17-openjdk
+    JAVA_HOME: /usr/lib/jvm/java-${{vars.java-version}}-openjdk
 
 pipeline:
   - uses: git-checkout
@@ -65,6 +68,53 @@ pipeline:
   - uses: strip
 
 subpackages:
+  - name: ${{package.name}}-compat
+    description: Compatibility layer for upstream image compatibiliy
+    dependencies:
+      runtime:
+        - ${{package.name}}
+    pipeline:
+      - runs: |
+          # The upstream image expects files in /deployments/quarkus-app/
+          # while Wolfi installs to /usr/share/java/apicurio-registry/quarkus-app/
+          # Create symlinks to match the official image layout.
+          mkdir -p "${{targets.contextdir}}/deployments"
+          ln -sf /usr/share/java/apicurio-registry/quarkus-app "${{targets.contextdir}}/deployments/quarkus-app"
+
+          # Create data and meta directories for runtime storage
+          # These are empty in the upstream image but expected to exist
+          mkdir -p "${{targets.contextdir}}/deployments/data"
+          mkdir -p "${{targets.contextdir}}/deployments/meta"
+    test:
+      environment:
+        contents:
+          packages:
+            - openjdk-${{vars.java-version}}-default-jvm
+            - ${{package.name}}
+        environment:
+          JAVA_HOME: /usr/lib/jvm/java-${{vars.java-version}}-openjdk
+      pipeline:
+        - uses: test/tw/symlink-check
+          with:
+            allow-absolute: true
+        - name: Verify compat directories exist
+          runs: |
+            # Verify data and meta directories exist
+            test -d /deployments/data
+            test -d /deployments/meta
+
+            # Verify quarkus-run.jar is accessible via the compat path
+            test -f /deployments/quarkus-app/quarkus-run.jar
+        - name: Verify can start from compat path
+          uses: test/daemon-check-output
+          with:
+            setup: cd /deployments/quarkus-app
+            start: java -jar /deployments/quarkus-app/quarkus-run.jar
+            timeout: 60
+            expected_output: |
+              constructed successfully
+              Initializing the Apicurio Registry
+
   - name: ${{package.name}}-ui
     description: Web UI for Apicurio Registry (apicurio-registry-ui)
     dependencies:
@@ -88,6 +138,7 @@ subpackages:
     dependencies:
       runtime:
         - docker-nginx
+        - nginx
     pipeline:
       - working-directory: ui
         runs: |
@@ -95,7 +146,7 @@ subpackages:
           config_dest="${{targets.contextdir}}/usr/local/bin/"
           install -Dm644 .docker-scripts/create-config.cjs "${config_dest}/create-config.cjs"
           install -Dm644 .docker-scripts/update-base-href.cjs "${config_dest}/update-base-href.cjs"
-          install -Dm644 .docker-scripts/nginx.conf "${config_dest}/etc/nginx/nginx.conf"
+          install -Dm644 .docker-scripts/nginx.conf "${{targets.contextdir}}/etc/nginx/nginx.conf"
           install -Dm755 .docker-scripts/entrypoint.sh "${config_dest}/entrypoint.sh"
 
 update:
@@ -110,12 +161,12 @@ test:
   environment:
     contents:
       packages:
-        - openjdk-17-default-jvm
+        - openjdk-${{vars.java-version}}-default-jvm
         - bash
         - curl
         - jq
     environment:
-      JAVA_HOME: /usr/lib/jvm/java-17-openjdk
+      JAVA_HOME: /usr/lib/jvm/java-${{vars.java-version}}-openjdk
       DEST: /usr/share/java/apicurio-registry
   pipeline:
     - name: Validate essential JARs