diff --git a/.github/workflows/build_main.yaml b/.github/workflows/build_main.yaml
index 7312e8b2fc0..57fe1fdcd2a 100644
--- a/.github/workflows/build_main.yaml
+++ b/.github/workflows/build_main.yaml
@@ -20,7 +20,7 @@ jobs:
       env:
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-        REGISTRY: projectcontour
+        REGISTRY: docker.io/projectcontour
         VERSION: main
         TAG_LATEST: "false"
         PUSH_IMAGE: "true"
diff --git a/.github/workflows/build_tag.yaml b/.github/workflows/build_tag.yaml
index e2fa63450d2..e7556e6f128 100644
--- a/.github/workflows/build_tag.yaml
+++ b/.github/workflows/build_tag.yaml
@@ -25,6 +25,7 @@ jobs:
         version: latest
     - name: Build and Push to Docker Hub
       env:
+        REGISTRY: docker.io/projectcontour
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
         TAG_LATEST: "false"
diff --git a/.github/workflows/prbuild.yaml b/.github/workflows/prbuild.yaml
index f8e7785501a..c42ac54c0ad 100644
--- a/.github/workflows/prbuild.yaml
+++ b/.github/workflows/prbuild.yaml
@@ -142,7 +142,7 @@ jobs:
           NODEIMAGE: ${{ matrix.node_image }}
           LOAD_PREBUILT_IMAGE: "true"
         run: |
-          export CONTOUR_UPGRADE_TO_IMAGE="projectcontour/contour:$(ls ./image/contour-*.tar | sed -E 's/.*-(.*).tar/\1/')"
+          export CONTOUR_UPGRADE_TO_IMAGE="ghcr.io/projectcontour/contour:$(ls ./image/contour-*.tar | sed -E 's/.*-(.*).tar/\1/')"
           make upgrade
       - uses: act10ns/slack@v1
         with:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dbc7c4f7a84..a951e4031e4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -244,7 +244,7 @@ xdscache_v3 "github.com/projectcontour/contour/internal/xdscache/v3"
 Before a change is submitted it should pass all the pre commit CI jobs.
 If there are unrelated test failures the change can be merged so long as a reference to an issue that tracks the test failures is provided.
 
-Once a change lands in main it will be built and available at this tag, `docker.io/projectcontour/contour:main`.
+Once a change lands in main it will be built and available at this tag, `ghcr.io/projectcontour/contour:main`.
 You can read more about the available contour images in the [tagging][7] document.
 
 ### Build an image
@@ -252,16 +252,16 @@ You can read more about the available contour images in the [tagging][7] documen
 To build an image of your change using Contour's `Dockerfile`, run these commands (replacing the repository host and tag with your own):
 
 ```
-docker build -t docker.io/davecheney/contour:latest .
-docker push docker.io/davecheney/contour:latest
+docker build -t ghcr.io/davecheney/contour:latest .
+docker push ghcr.io/davecheney/contour:latest
 ```
 or, you can use the make helper, like so:
 
 ```
-REGISTRY=docker.io/davecheney VERSION=latest make push
+REGISTRY=ghcr.io/davecheney VERSION=latest make push
 ```
 
-This will push to `:latest` in `docker.io/davecheney` obviously you'll also need to replace the repo host with your own here too. If you don't specify `VERSION`, `make push` will push to a git hash tag (the output of ` git rev-parse --short=8 --verify HEAD`).
+This will push to `:latest` in `ghcr.io/davecheney` obviously you'll also need to replace the repo host with your own here too. If you don't specify `VERSION`, `make push` will push to a git hash tag (the output of ` git rev-parse --short=8 --verify HEAD`).
 
 ### Verify your change
 
diff --git a/Makefile b/Makefile
index ed8b166fe13..eb6841cf72f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 ORG = projectcontour
 PROJECT = contour
 MODULE = github.com/$(ORG)/$(PROJECT)
-REGISTRY ?= projectcontour
+REGISTRY ?= ghcr.io/projectcontour
 IMAGE := $(REGISTRY)/$(PROJECT)
 SRCDIRS := ./cmd ./internal ./apis
 LOCAL_BOOTSTRAP_CONFIG = localenvoyconfig.yaml
@@ -19,7 +19,7 @@ LOCALIP ?= $(shell ifconfig | grep inet | grep -v '::' | grep -v 127.0.0.1 | hea
 CONTOUR_E2E_LOCAL_HOST ?= $(LOCALIP)
 # Variables needed for running upgrade tests.
 CONTOUR_UPGRADE_FROM_VERSION ?= $(shell ./test/scripts/get-contour-upgrade-from-version.sh)
-CONTOUR_UPGRADE_TO_IMAGE ?= projectcontour/contour:main
+CONTOUR_UPGRADE_TO_IMAGE ?= ghcr.io/projectcontour/contour:main
 
 TAG_LATEST ?= false
 
diff --git a/examples/contour/02-job-certgen.yaml b/examples/contour/02-job-certgen.yaml
index cfe20f0b2c8..35ba3d2fc7d 100644
--- a/examples/contour/02-job-certgen.yaml
+++ b/examples/contour/02-job-certgen.yaml
@@ -47,7 +47,7 @@ spec:
     spec:
       containers:
       - name: contour
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: Always
         command:
         - contour
diff --git a/examples/contour/03-contour.yaml b/examples/contour/03-contour.yaml
index ef55bc0d1d6..6efbc11821d 100644
--- a/examples/contour/03-contour.yaml
+++ b/examples/contour/03-contour.yaml
@@ -45,7 +45,7 @@ spec:
         - --contour-key-file=/certs/tls.key
         - --config-path=/config/contour.yaml
         command: ["contour"]
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: Always
         name: contour
         ports:
diff --git a/examples/contour/03-envoy.yaml b/examples/contour/03-envoy.yaml
index 0b919f0514e..d8ba6edf4d3 100644
--- a/examples/contour/03-envoy.yaml
+++ b/examples/contour/03-envoy.yaml
@@ -29,7 +29,7 @@ spec:
         args:
           - envoy
           - shutdown-manager
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: Always
         lifecycle:
           preStop:
@@ -113,7 +113,7 @@ spec:
         - --envoy-key-file=/certs/tls.key
         command:
         - contour
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: Always
         name: envoy-initconfig
         volumeMounts:
diff --git a/examples/render/contour-gateway.yaml b/examples/render/contour-gateway.yaml
index c23911f73f9..2b936b3efa3 100644
--- a/examples/render/contour-gateway.yaml
+++ b/examples/render/contour-gateway.yaml
@@ -2725,7 +2725,7 @@ spec:
     spec:
       containers:
       - name: contour
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: Always
         command:
         - contour
@@ -2996,7 +2996,7 @@ spec:
         - --contour-key-file=/certs/tls.key
         - --config-path=/config/contour.yaml
         command: ["contour"]
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: IfNotPresent
         name: contour
         ports:
@@ -3085,7 +3085,7 @@ spec:
         args:
           - envoy
           - shutdown-manager
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
@@ -3169,7 +3169,7 @@ spec:
         - --envoy-key-file=/certs/tls.key
         command:
         - contour
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: IfNotPresent
         name: envoy-initconfig
         volumeMounts:
diff --git a/examples/render/contour.yaml b/examples/render/contour.yaml
index bdd0a017bce..f600fafad1e 100644
--- a/examples/render/contour.yaml
+++ b/examples/render/contour.yaml
@@ -2722,7 +2722,7 @@ spec:
     spec:
       containers:
       - name: contour
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: Always
         command:
         - contour
@@ -2993,7 +2993,7 @@ spec:
         - --contour-key-file=/certs/tls.key
         - --config-path=/config/contour.yaml
         command: ["contour"]
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: IfNotPresent
         name: contour
         ports:
@@ -3082,7 +3082,7 @@ spec:
         args:
           - envoy
           - shutdown-manager
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
@@ -3166,7 +3166,7 @@ spec:
         - --envoy-key-file=/certs/tls.key
         command:
         - contour
-        image: docker.io/projectcontour/contour:main
+        image: ghcr.io/projectcontour/contour:main
         imagePullPolicy: IfNotPresent
         name: envoy-initconfig
         volumeMounts:
diff --git a/hack/release/make-release-tag.sh b/hack/release/make-release-tag.sh
index 67cd418e206..68590d8e018 100755
--- a/hack/release/make-release-tag.sh
+++ b/hack/release/make-release-tag.sh
@@ -18,7 +18,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-readonly IMG="docker.io/projectcontour/contour:$NEWVERS"
+readonly IMG="ghcr.io/projectcontour/contour:$NEWVERS"
 
 if [ -n "$(git tag --list "$NEWVERS")" ]; then
     printf "%s: tag '%s' already exists\n" "$PROGNAME" "$NEWVERS"
@@ -39,8 +39,8 @@ for example in examples/contour/03-envoy.yaml examples/contour/03-contour.yaml e
     # The version might be main or OLDVERS depending on whether we are
     # tagging from the release branch or from main.
     run::sed \
-        "-es|docker.io/projectcontour/contour:main|$IMG|" \
-        "-es|docker.io/projectcontour/contour:$OLDVERS|$IMG|" \
+        "-es|ghcr.io/projectcontour/contour:main|$IMG|" \
+        "-es|ghcr.io/projectcontour/contour:$OLDVERS|$IMG|" \
         "$example"
 done
 
diff --git a/site/content/docs/main/redeploy-envoy.md b/site/content/docs/main/redeploy-envoy.md
index 4f7e4cb0372..b567b585b68 100644
--- a/site/content/docs/main/redeploy-envoy.md
+++ b/site/content/docs/main/redeploy-envoy.md
@@ -25,7 +25,7 @@ It exposes two HTTP endpoints which are used for `livenessProbe` as well as to h
    args:
      - envoy
      - shutdown-manager
-   image: docker.io/projectcontour/contour:main
+   image: ghcr.io/projectcontour/contour:main
    imagePullPolicy: Always
    lifecycle:
      preStop:
@@ -76,4 +76,4 @@ The shutdown command has a few arguments that can be passed to change how it beh
 | <nobr>admin-port (Deprecated)</nobr> | integer | 9001 | Deprecated: No longer used, Envoy admin interface runs as a unix socket.  |
 | <nobr>admin-address</nobr> | string | /admin/admin.sock | Path to Envoy admin unix domain socket. |
 
-  [1]: ../img/shutdownmanager.png
\ No newline at end of file
+  [1]: ../img/shutdownmanager.png
diff --git a/site/content/examples/authdemo/02-certsjob.yaml b/site/content/examples/authdemo/02-certsjob.yaml
index 4540bcd3f00..eaa916e81ac 100644
--- a/site/content/examples/authdemo/02-certsjob.yaml
+++ b/site/content/examples/authdemo/02-certsjob.yaml
@@ -47,7 +47,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: docker.io/projectcontour/contour:main
+          image: ghcr.io/projectcontour/contour:main
           imagePullPolicy: Always
           command:
             - contour
diff --git a/test/scripts/install-contour-working.sh b/test/scripts/install-contour-working.sh
index 2f21c635ae7..55c899debd6 100755
--- a/test/scripts/install-contour-working.sh
+++ b/test/scripts/install-contour-working.sh
@@ -68,10 +68,10 @@ if [ "${LOAD_PREBUILT_IMAGE}" = "true" ]; then
 else
     # Build the current version of Contour.
     VERSION="v$$"
-    make -C ${REPO} container IMAGE=docker.io/projectcontour/contour VERSION=$VERSION
+    make -C ${REPO} container IMAGE=ghcr.io/projectcontour/contour VERSION=$VERSION
 
     # Push the Contour build image into the cluster.
-    kind::cluster::load::docker docker.io/projectcontour/contour:${VERSION}
+    kind::cluster::load::docker ghcr.io/projectcontour/contour:${VERSION}
 fi
 
 
@@ -94,7 +94,7 @@ for file in ${REPO}/examples/contour/02-job-certgen.yaml ${REPO}/examples/contou
   # Set the image tag to $VERSION to unambiguously use the image
   # we built above.
   run::sed \
-    "-es|image: docker.io/projectcontour/contour:.*$|image: docker.io/projectcontour/contour:${VERSION}|" \
+    "-es|image: ghcr.io/projectcontour/contour:.*$|image: ghcr.io/projectcontour/contour:${VERSION}|" \
     "$file"
 
   ${KUBECTL} apply -f "$file"