diff --git a/e2e/js_image_oci/.bazelignore b/e2e/js_image_oci/.bazelignore
index c8c6ad9bae..1fb12a1df7 100644
--- a/e2e/js_image_oci/.bazelignore
+++ b/e2e/js_image_oci/.bazelignore
@@ -1,2 +1,4 @@
 node_modules
+pkg/a/node_modules
+pkg/b/node_modules
 repo
\ No newline at end of file
diff --git a/e2e/js_image_oci/MODULE.bazel b/e2e/js_image_oci/MODULE.bazel
index e538660cab..586596d010 100644
--- a/e2e/js_image_oci/MODULE.bazel
+++ b/e2e/js_image_oci/MODULE.bazel
@@ -10,11 +10,7 @@ bazel_dep(name = "platforms", version = "0.0.10", dev_dependency = True)
 bazel_dep(name = "rules_nodejs", version = "5.8.2", dev_dependency = True)
 bazel_dep(name = "rules_oci", version = "1.7.5", dev_dependency = True)
 
-npm = use_extension(
-    "@aspect_rules_js//npm:extensions.bzl",
-    "npm",
-    dev_dependency = True,
-)
+npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm", dev_dependency = True)
 npm.npm_translate_lock(
     name = "npm",
     pnpm_lock = "//:pnpm-lock.yaml",
@@ -22,7 +18,7 @@ npm.npm_translate_lock(
 )
 use_repo(npm, "npm")
 
-oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
+oci = use_extension("@rules_oci//oci:extensions.bzl", "oci", dev_dependency = True)
 oci.pull(
     name = "debian",
     digest = "sha256:3d868b5eb908155f3784317b3dda2941df87bbbbaa4608f84881de66d9bb297b",
@@ -40,9 +36,13 @@ oci.pull(
 )
 use_repo(oci, "debian")
 
-node = use_extension(
-    "@rules_nodejs//nodejs:extensions.bzl",
-    "node",
-    dev_dependency = True,
-)
+node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node", dev_dependency = True)
 use_repo(node, "nodejs_toolchains")
+
+pnpm = use_extension("@aspect_rules_js//npm:extensions.bzl", "pnpm", dev_dependency = True)
+pnpm.pnpm(
+    name = "pnpm_dev",
+    pnpm_version = "8.6.7",
+    pnpm_version_integrity = "sha512-vRIWpD/L4phf9Bk2o/O2TDR8fFoJnpYrp2TKqTIZF/qZ2/rgL3qKXzHofHgbXsinwMoSEigz28sqk3pQ+yMEQQ==",
+)
+use_repo(pnpm, "pnpm_dev")
diff --git a/e2e/js_image_oci/package.json b/e2e/js_image_oci/package.json
index c55292ce50..d3580608c3 100644
--- a/e2e/js_image_oci/package.json
+++ b/e2e/js_image_oci/package.json
@@ -1,6 +1,9 @@
 {
     "name": "image",
     "dependencies": {
-        "chalk": "^4.0.0"
+        "acorn": "8.7.1",
+        "chalk": "^4.0.0",
+        "@mycorp/pkg-a": "workspace:*",
+        "@mycorp/pkg-b": "workspace:*"
     }
 }
diff --git a/e2e/js_image_oci/pkg/a/BUILD.bazel b/e2e/js_image_oci/pkg/a/BUILD.bazel
new file mode 100644
index 0000000000..d34357214c
--- /dev/null
+++ b/e2e/js_image_oci/pkg/a/BUILD.bazel
@@ -0,0 +1,16 @@
+load("@aspect_rules_js//npm:defs.bzl", "npm_package")
+load("@npm//:defs.bzl", "npm_link_all_packages")
+
+npm_link_all_packages(name = "node_modules")
+
+npm_package(
+    name = "pkg",
+    srcs = [
+        "index.js",
+        "package.json",
+    ],
+    data = [
+        ":node_modules",
+    ],
+    visibility = ["//visibility:public"],
+)
diff --git a/e2e/js_image_oci/pkg/a/index.js b/e2e/js_image_oci/pkg/a/index.js
new file mode 100644
index 0000000000..1f3b24d0e8
--- /dev/null
+++ b/e2e/js_image_oci/pkg/a/index.js
@@ -0,0 +1,17 @@
+/**
+ * @fileoverview minimal test program that requires third-party packages from npm
+ */
+const acorn = require('acorn')
+
+function getAcornVersion() {
+    return acorn.version
+}
+
+function getUuidVersion() {
+    return require('uuid/package.json').version
+}
+
+module.exports = {
+    getAcornVersion,
+    getUuidVersion,
+}
diff --git a/e2e/js_image_oci/pkg/a/package.json b/e2e/js_image_oci/pkg/a/package.json
new file mode 100644
index 0000000000..33f2de5d95
--- /dev/null
+++ b/e2e/js_image_oci/pkg/a/package.json
@@ -0,0 +1,10 @@
+{
+    "name": "@mycorp/pkg-a",
+    "private": true,
+    "dependencies": {
+        "uuid": "9.0.1"
+    },
+    "peerDependencies": {
+        "acorn": "8.x.x"
+    }
+}
diff --git a/e2e/js_image_oci/pkg/b/BUILD.bazel b/e2e/js_image_oci/pkg/b/BUILD.bazel
new file mode 100644
index 0000000000..366b368fcc
--- /dev/null
+++ b/e2e/js_image_oci/pkg/b/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@aspect_rules_js//js:defs.bzl", "js_library")
+load("@npm//:defs.bzl", "npm_link_all_packages")
+
+npm_link_all_packages(name = "node_modules")
+
+js_library(
+    name = "pkg",
+    srcs = [
+        "index.js",
+        "package.json",
+    ],
+    visibility = ["//visibility:public"],
+    # because we're linking this js_library, we must explictly add our npm dependendies to `deps` so
+    # they are picked up my the linker. npm dependendies in `data` are not propogated through the
+    # linker when linking a js_libary.
+    deps = [
+        ":node_modules",
+    ],
+)
diff --git a/e2e/js_image_oci/pkg/b/index.js b/e2e/js_image_oci/pkg/b/index.js
new file mode 100644
index 0000000000..1f3b24d0e8
--- /dev/null
+++ b/e2e/js_image_oci/pkg/b/index.js
@@ -0,0 +1,17 @@
+/**
+ * @fileoverview minimal test program that requires third-party packages from npm
+ */
+const acorn = require('acorn')
+
+function getAcornVersion() {
+    return acorn.version
+}
+
+function getUuidVersion() {
+    return require('uuid/package.json').version
+}
+
+module.exports = {
+    getAcornVersion,
+    getUuidVersion,
+}
diff --git a/e2e/js_image_oci/pkg/b/package.json b/e2e/js_image_oci/pkg/b/package.json
new file mode 100644
index 0000000000..95862f6c8f
--- /dev/null
+++ b/e2e/js_image_oci/pkg/b/package.json
@@ -0,0 +1,10 @@
+{
+    "name": "@mycorp/pkg-b",
+    "private": true,
+    "dependencies": {
+        "uuid": "8.3.2"
+    },
+    "peerDependencies": {
+        "acorn": "8.x.x"
+    }
+}
diff --git a/e2e/js_image_oci/pnpm-lock.yaml b/e2e/js_image_oci/pnpm-lock.yaml
index 6e664d33dd..ccdcbf0dd3 100644
--- a/e2e/js_image_oci/pnpm-lock.yaml
+++ b/e2e/js_image_oci/pnpm-lock.yaml
@@ -1,16 +1,58 @@
-lockfileVersion: '6.1'
+lockfileVersion: '6.0'
 
 settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
-dependencies:
-  chalk:
-    specifier: ^4.0.0
-    version: 4.0.0
+importers:
+
+  .:
+    dependencies:
+      '@mycorp/pkg-a':
+        specifier: workspace:*
+        version: link:pkg/a
+      '@mycorp/pkg-b':
+        specifier: workspace:*
+        version: link:pkg/b
+      acorn:
+        specifier: 8.7.1
+        version: 8.7.1
+      chalk:
+        specifier: ^4.0.0
+        version: 4.0.0
+
+  pkg/a:
+    dependencies:
+      acorn:
+        specifier: 8.x.x
+        version: 8.0.0
+      uuid:
+        specifier: 9.0.1
+        version: 9.0.1
+
+  pkg/b:
+    dependencies:
+      acorn:
+        specifier: 8.x.x
+        version: 8.0.0
+      uuid:
+        specifier: 8.3.2
+        version: 8.3.2
 
 packages:
 
+  /acorn@8.0.0:
+    resolution: {integrity: sha512-wuJmBvKP9pkjPd2m+6skNcgK6S43df5cRbUTWQlns8rukcu5bcSvx9eZjvNXTtFe4+oCslAvIhNCvYBe/69xMw==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+    dev: false
+
+  /acorn@8.7.1:
+    resolution: {integrity: sha512-Xx54uLJQZ19lKygFXOWsscKUbsBZW0CPykPhVQdhIeIwrbPmJzqeASDInc8nKBnp/JT6igTs82qPXz069H8I/A==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+    dev: false
+
   /ansi-styles@4.3.0:
     resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
     engines: {node: '>=8'}
@@ -48,3 +90,13 @@ packages:
     dependencies:
       has-flag: 4.0.0
     dev: false
+
+  /uuid@8.3.2:
+    resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==}
+    hasBin: true
+    dev: false
+
+  /uuid@9.0.1:
+    resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==}
+    hasBin: true
+    dev: false
diff --git a/e2e/js_image_oci/pnpm-workspace.yaml b/e2e/js_image_oci/pnpm-workspace.yaml
index 2cce0eb743..e3dc77149f 100644
--- a/e2e/js_image_oci/pnpm-workspace.yaml
+++ b/e2e/js_image_oci/pnpm-workspace.yaml
@@ -1,2 +1,3 @@
 packages:
-    - '.'
+    - 'pkg/a'
+    - 'pkg/b'
diff --git a/e2e/js_image_oci/src/BUILD.bazel b/e2e/js_image_oci/src/BUILD.bazel
index f2c4259780..b1ac210df3 100644
--- a/e2e/js_image_oci/src/BUILD.bazel
+++ b/e2e/js_image_oci/src/BUILD.bazel
@@ -32,6 +32,7 @@ js_binary(
     data = [
         "ascii.art",
         ":proto",
+        "//:node_modules/@mycorp/pkg-a",
         "//:node_modules/chalk",
         "@repo//:dir",
         "@repo//:source_txt",
diff --git a/e2e/js_image_oci/src/main.js b/e2e/js_image_oci/src/main.js
index 146e0af546..e8ee4057ef 100644
--- a/e2e/js_image_oci/src/main.js
+++ b/e2e/js_image_oci/src/main.js
@@ -39,6 +39,11 @@ console.log(
 )
 console.log('')
 
+const pkgA = require('@mycorp/pkg-a')
+console.log(`@mycorp/pkg-a acorn@${pkgA.getAcornVersion()}`)
+console.log(`@mycorp/pkg-a uuid@${pkgA.getUuidVersion()}`)
+console.log('')
+
 console.log(
     chalk.bold.bgYellow(' SOURCE CHECK '),
     space,
@@ -48,7 +53,6 @@ console.log(
         )
     )
 )
-
 console.log(
     chalk.bold.bgMagenta(' DIRECTORY CHECK '),
     space,
@@ -58,7 +62,6 @@ console.log(
         )
     )
 )
-
 console.log(
     chalk.bold.bgMagenta(' SOURCE DIRECTORY CHECK '),
     space,
@@ -68,7 +71,6 @@ console.log(
         )
     )
 )
-
 console.log(
     chalk.bold.bgWhite(' PROTO CHECK '),
     space,
diff --git a/e2e/js_image_oci/src/test.yaml b/e2e/js_image_oci/src/test.yaml
index 724c100487..0f030e077c 100644
--- a/e2e/js_image_oci/src/test.yaml
+++ b/e2e/js_image_oci/src/test.yaml
@@ -12,6 +12,8 @@ commandTests:
               ' TARGET    //src:bin',
               ' CWD    /app/src/bin.runfiles/',
               ' JS_BINARY__RUNFILES    /app/src/bin.runfiles',
+              '@mycorp/pkg-a acorn@7.4.0',
+              '@mycorp/pkg-a uuid@9.0.1',
               ' SOURCE CHECK    true',
               ' DIRECTORY CHECK    true',
               ' PROTO CHECK    true',
@@ -27,6 +29,8 @@ commandTests:
               ' TARGET    //src:bin',
               ' CWD    /app/src/bin.runfiles/',
               ' JS_BINARY__RUNFILES    /app/src/bin.runfiles',
+              '@mycorp/pkg-a acorn@7.4.0',
+              '@mycorp/pkg-a uuid@9.0.1',
               ' SOURCE CHECK    true',
               ' DIRECTORY CHECK    true',
               ' PROTO CHECK    true',