diff --git a/.github/workflows/install-test.yml b/.github/workflows/install-test.yml
index 1e8470e..761ab7f 100644
--- a/.github/workflows/install-test.yml
+++ b/.github/workflows/install-test.yml
@@ -50,7 +50,7 @@ jobs:
           sudo chmod 0666 /dev/kvm
           docker run --rm --device /dev/kvm -v "$PWD:/w" -w /w \
             -e OMARCHY_INTEGRATION_DISK_CACHE=none \
-            archlinux:latest bash -euo pipefail -c '
+            ghcr.io/archlinux/archlinux:latest bash -euo pipefail -c '
               # pacman 7 fails every sync on a kernel without Landlock, which
               # these runners have; builder/build-iso.sh does the same.
               if ! grep -qw landlock /sys/kernel/security/lsm 2>/dev/null; then
diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml
index 5bd0333..f718bec 100644
--- a/.github/workflows/nightly-build.yml
+++ b/.github/workflows/nightly-build.yml
@@ -132,7 +132,7 @@ jobs:
           sudo chmod 0666 /dev/kvm
           docker run --rm --device /dev/kvm -v "$PWD:/w" -w /w \
             -e OMARCHY_INTEGRATION_DISK_CACHE=none \
-            archlinux:latest bash -euo pipefail -c '
+            ghcr.io/archlinux/archlinux:latest bash -euo pipefail -c '
               # pacman 7 fails every sync on a kernel without Landlock, which
               # these runners have; builder/build-iso.sh does the same.
               if ! grep -qw landlock /sys/kernel/security/lsm 2>/dev/null; then
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 137346f..e13df6c 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -33,7 +33,7 @@ jobs:
         run: |
           docker run -d --name unit --privileged --cgroupns=host \
             -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /tmp:exec \
-            -v "$PWD:/src:ro" archlinux:latest bash -c '
+            -v "$PWD:/src:ro" ghcr.io/archlinux/archlinux:latest bash -c '
               systemctl mask getty.target console-getty.service \
                 systemd-udev-trigger.service systemd-udevd.service \
                 systemd-vconsole-setup.service
diff --git a/bin/omarchy-iso-make b/bin/omarchy-iso-make
index 5dbbeff..0315c3f 100755
--- a/bin/omarchy-iso-make
+++ b/bin/omarchy-iso-make
@@ -166,7 +166,7 @@ if ! docker version &>/dev/null; then
   DOCKER=(sudo docker)
 fi
 
-"${DOCKER[@]}" run "${DOCKER_ARGS[@]}" archlinux/archlinux:latest /$BUILD_SCRIPT
+"${DOCKER[@]}" run "${DOCKER_ARGS[@]}" ghcr.io/archlinux/archlinux:latest /$BUILD_SCRIPT
 
 latest_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*.iso | head -n1)
 iso_ref="${latest_iso%.*}-$OMARCHY_ISO_REF.iso"