diff --git a/ociregistry/ociclient/reader.go b/ociregistry/ociclient/reader.go
index f410d92..ba942f4 100644
--- a/ociregistry/ociclient/reader.go
+++ b/ociregistry/ociclient/reader.go
@@ -97,7 +97,7 @@ func (c *client) resolve(ctx context.Context, rreq *ocirequest.Request) (ociregi
 		return ociregistry.Descriptor{}, err
 	}
 	resp.Body.Close()
-	desc, err := descriptorFromResponse(resp, "", true)
+	desc, err := descriptorFromResponse(resp, ociregistry.Digest(rreq.Digest), true)
 	if err != nil {
 		return ociregistry.Descriptor{}, fmt.Errorf("invalid descriptor in response: %v", err)
 	}
@@ -176,7 +176,7 @@ func (c *client) read(ctx context.Context, rreq *ocirequest.Request) (_ ociregis
 				return nil, err
 			}
 			resp1.Body.Close()
-			desc, err = descriptorFromResponse(resp1, "", true)
+			desc, err = descriptorFromResponse(resp1, ociregistry.Digest(rreq1.Digest), true)
 			if err != nil {
 				return nil, err
 			}
diff --git a/ociregistry/ociserver/reader.go b/ociregistry/ociserver/reader.go
index bd5952a..71c2823 100644
--- a/ociregistry/ociserver/reader.go
+++ b/ociregistry/ociserver/reader.go
@@ -147,7 +147,13 @@ func (r *registry) handleManifestHead(ctx context.Context, resp http.ResponseWri
 	if err != nil {
 		return err
 	}
-	resp.Header().Set("Docker-Content-Digest", string(desc.Digest))
+	if !r.opts.OmitDigestFromTagGetResponse || rreq.Tag != "" {
+		// Note: when doing a HEAD of a tag, clients are entitled
+		// to expect that the digest header is set on the response
+		// even though the spec says it's only optional in this case.
+		// TODO raise an issue on the spec about this.
+		resp.Header().Set("Docker-Content-Digest", string(desc.Digest))
+	}
 	resp.Header().Set("Content-Type", desc.MediaType)
 	resp.Header().Set("Content-Length", fmt.Sprint(desc.Size))
 	resp.WriteHeader(http.StatusOK)