diff --git a/cmd/protoc-gen-go-fieldpath/generator.go b/cmd/protoc-gen-go-fieldpath/generator.go
index b651f1b06579b..103afdcb79bfe 100644
--- a/cmd/protoc-gen-go-fieldpath/generator.go
+++ b/cmd/protoc-gen-go-fieldpath/generator.go
@@ -107,14 +107,27 @@ func (gen *generator) genFieldMethod(m *protogen.Message) {
 				p.P("}")
 				p.P("return m.", f.GoName, ".Field(fieldpath[1:])")
 			case f.Desc.Kind() == protoreflect.StringKind:
-				p.P("return string(m.", f.GoName, "), len(m.", f.GoName, ") > 0")
+				if f.Desc.HasPresence() {
+					p.P("if m.", f.GoName, " == nil {")
+					p.P(`return "", false`)
+					p.P("}")
+					p.P("return *m.", f.GoName, ", true")
+				} else {
+					p.P("return string(m.", f.GoName, "), len(m.", f.GoName, ") > 0")
+				}
 			case f.Desc.Kind() == protoreflect.BoolKind:
 				fmtSprint := gen.out.QualifiedGoIdent(protogen.GoIdent{
 					GoImportPath: "fmt",
 					GoName:       "Sprint",
 				})
-
-				p.P("return ", fmtSprint, "(m.", f.GoName, "), true")
+				if f.Desc.HasPresence() {
+					p.P("if m.", f.GoName, " == nil {")
+					p.P(`return "", false`)
+					p.P("}")
+					p.P("return ", fmtSprint, "(*m.", f.GoName, "), true")
+				} else {
+					p.P("return ", fmtSprint, "(m.", f.GoName, "), true")
+				}
 			}
 		}
 
diff --git a/cmd/protoc-gen-go-fieldpath/main.go b/cmd/protoc-gen-go-fieldpath/main.go
index faa2005d2f4c8..5b6a8ea76190d 100644
--- a/cmd/protoc-gen-go-fieldpath/main.go
+++ b/cmd/protoc-gen-go-fieldpath/main.go
@@ -18,10 +18,12 @@ package main
 
 import (
 	"google.golang.org/protobuf/compiler/protogen"
+	"google.golang.org/protobuf/types/pluginpb"
 )
 
 func main() {
 	protogen.Options{}.Run(func(gen *protogen.Plugin) error {
+		gen.SupportedFeatures = uint64(pluginpb.CodeGeneratorResponse_FEATURE_PROTO3_OPTIONAL)
 		for _, f := range gen.Files {
 			if !f.Generate {
 				continue
diff --git a/contrib/apparmor/template.go b/contrib/apparmor/template.go
index 6758fd02fea5c..b63cf509fb1d4 100644
--- a/contrib/apparmor/template.go
+++ b/contrib/apparmor/template.go
@@ -72,7 +72,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
 
   deny @{PROC}/* w,   # deny write for all files directly in /proc (not in a subdir)
   # deny write to files not in /proc/<number>/** or /proc/sys/**
-  deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
+  deny @{PROC}/{[^1-9/],[^1-9/][^0-9/],[^1-9s/][^0-9y/][^0-9s/],[^1-9/][^0-9/][^0-9/][^0-9/]*}/** w,
   deny @{PROC}/sys/[^k]** w,  # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel)
   deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w,  # deny everything except shm* in /proc/sys/kernel/
   deny @{PROC}/sysrq-trigger rwklx,
diff --git a/plugins/transfer/plugin.go b/plugins/transfer/plugin.go
index 6ab1041fbd140..cd4fd4ccd0244 100644
--- a/plugins/transfer/plugin.go
+++ b/plugins/transfer/plugin.go
@@ -17,6 +17,7 @@
 package transfer
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/containerd/errdefs"
@@ -71,7 +72,7 @@ func init() {
 			lc.Leases = l.(leases.Manager)
 
 			vps, err := ic.GetByType(plugins.ImageVerifierPlugin)
-			if err != nil {
+			if err != nil && !errors.Is(err, plugin.ErrPluginNotFound) {
 				return nil, err
 			}
 			if len(vps) > 0 {