diff --git a/.github/workflows/commandbox-install-smoke.yml b/.github/workflows/commandbox-install-smoke.yml
index 0981b74066..d576ea6c32 100644
--- a/.github/workflows/commandbox-install-smoke.yml
+++ b/.github/workflows/commandbox-install-smoke.yml
@@ -73,7 +73,7 @@ jobs:
     # for ForgeBox publishing (its "Install CommandBox" step), just containerized
     # so the box server boots in the same userland it serves from.
     container:
-      image: ortussolutions/commandbox:latest
+      image: ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest
     env:
       # Throwaway values for the CI app; not secrets.
       SMOKE_RELOAD_PASSWORD: "wheels-dev"
diff --git a/.github/workflows/distribution-install-smoke.yml b/.github/workflows/distribution-install-smoke.yml
index fce3485071..e20b832b65 100644
--- a/.github/workflows/distribution-install-smoke.yml
+++ b/.github/workflows/distribution-install-smoke.yml
@@ -526,9 +526,9 @@ jobs:
       matrix:
         include:
           - label: "rocky 10, rpm 4.19"
-            image: rockylinux/rockylinux:10
+            image: ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:10
           - label: "rocky 9, rpm 4.16"
-            image: rockylinux/rockylinux:9
+            image: ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:9
     container:
       image: ${{ matrix.image }}
     env:
@@ -576,7 +576,7 @@ jobs:
     # Gates (hard-fail): as of 4.0.5 the rpm's wrapper resolves the RHEL/Fedora
     # Java-21 layout, so `wheels --version` works on Rocky 9 (was the 4.0.4 bug).
     container:
-      image: rockylinux:9
+      image: ghcr.io/wheels-dev/mirror/rockylinux:9
     env:
       EXPECTED: ${{ needs.resolve.outputs.version }}
     steps:
@@ -643,7 +643,7 @@ jobs:
     # dependency (#4237) is what makes it installable. Bleeding-edge only for
     # now; a stable Fedora leg is owed once 4.2.0 ships with that dependency.
     container:
-      image: fedora:44
+      image: ghcr.io/wheels-dev/mirror/fedora:44
     steps:
       - name: Add yum.wheels.dev bleeding-edge + install (the documented path)
         run: |
diff --git a/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v1 b/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v1
index b7fa713f73..fc7ce60bef 100644
--- a/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v1
+++ b/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v1
@@ -11,5 +11,5 @@
 #   2. A follow-up task can build + `docker save` this into a tarball, load
 #      it into a dind service, and flip the test from "command-dispatch
 #      assertions" to "real HTTP v1 serves".
-FROM nginx:alpine
+FROM ghcr.io/wheels-dev/mirror/nginx:alpine
 RUN printf '%s\n' 'v1' > /usr/share/nginx/html/index.html
diff --git a/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v2 b/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v2
index da41fd0bb1..616540c650 100644
--- a/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v2
+++ b/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v2
@@ -1,4 +1,4 @@
 # Minimal nginx image that serves "v2" on /. See Dockerfile.v1 for why this
 # isn't built by the default E2E lifecycle.
-FROM nginx:alpine
+FROM ghcr.io/wheels-dev/mirror/nginx:alpine
 RUN printf '%s\n' 'v2' > /usr/share/nginx/html/index.html
diff --git a/cli/lucli/tests/_fixtures/deploy/e2e/docker-compose.yml b/cli/lucli/tests/_fixtures/deploy/e2e/docker-compose.yml
index 15ea400931..dab55d3f69 100644
--- a/cli/lucli/tests/_fixtures/deploy/e2e/docker-compose.yml
+++ b/cli/lucli/tests/_fixtures/deploy/e2e/docker-compose.yml
@@ -11,7 +11,7 @@ services:
   # Port 22024 — distinct from the plain sshd fixture (22022/22023) so both
   # fixtures can coexist during development.
   e2e-host:
-    image: linuxserver/openssh-server:latest
+    image: ghcr.io/wheels-dev/mirror/linuxserver/openssh-server:latest
     environment:
       PUBLIC_KEY_FILE: /keys/authorized_keys
       USER_NAME: deploy
diff --git a/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml b/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml
index 9f1a4466c4..3ab1b6463e 100644
--- a/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml
+++ b/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml
@@ -4,7 +4,7 @@
 # checkout finds the same config, and a deleted worktree can't leave a dangling mount.
 services:
   sshd1:
-    image: linuxserver/openssh-server:latest
+    image: ghcr.io/wheels-dev/mirror/linuxserver/openssh-server:latest
     environment:
       PUBLIC_KEY: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIED8dz5J/2zX6dKwp5Oqlp5wguhfg4lY0Pg91Z/tIa/h wheels-deploy-test"
       USER_NAME: deploy
@@ -14,7 +14,7 @@ services:
       - "22022:2222"
 
   sshd2:
-    image: linuxserver/openssh-server:latest
+    image: ghcr.io/wheels-dev/mirror/linuxserver/openssh-server:latest
     environment:
       PUBLIC_KEY: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIED8dz5J/2zX6dKwp5Oqlp5wguhfg4lY0Pg91Z/tIa/h wheels-deploy-test"
       USER_NAME: deploy
diff --git a/compose.yml b/compose.yml
index 046b0c053d..a4835545a8 100644
--- a/compose.yml
+++ b/compose.yml
@@ -367,7 +367,7 @@ services:
       - wheels-network
 
   mysql:
-    image: mysql:9.7.0
+    image: ghcr.io/wheels-dev/mirror/mysql:9.7.0
     restart: always
     environment:
       MYSQL_ROOT_PASSWORD: wheelstestdb
@@ -388,7 +388,7 @@ services:
       - wheels-network
 
   postgres:
-    image: postgres:18.4
+    image: ghcr.io/wheels-dev/mirror/postgres:18.4
     restart: always
     environment:
       POSTGRES_USER: wheelstestdb
diff --git a/tools/ci/ajp/compose.ajp.yml b/tools/ci/ajp/compose.ajp.yml
index a633d85c68..42f2c7174d 100644
--- a/tools/ci/ajp/compose.ajp.yml
+++ b/tools/ci/ajp/compose.ajp.yml
@@ -14,7 +14,7 @@ services:
         source: ${AJP_SERVER_JSON:?run through tools/ci/ajp/run.sh, which generates it}
         target: /wheels-test-suite/server.json
   httpd:
-    image: ${AJP_HTTPD_IMAGE:-httpd:2.4}
+    image: ${AJP_HTTPD_IMAGE:-ghcr.io/wheels-dev/mirror/httpd:2.4}
     network_mode: "service:lucee7"
     volumes:
       - type: bind
diff --git a/tools/ci/ajp/run.sh b/tools/ci/ajp/run.sh
index ff6d0031c6..fcf0de536c 100755
--- a/tools/ci/ajp/run.sh
+++ b/tools/ci/ajp/run.sh
@@ -21,7 +21,7 @@ PROJECT="${1:-wheels-ajp}"
 PORT="${AJP_HTTPD_PORT:-9590}"
 OUT="${AJP_RESULT_JSON:-$(mktemp)}"
 # compose.ajp.yml runs the same image the stock config is read from.
-export AJP_HTTPD_IMAGE="${AJP_HTTPD_IMAGE:-httpd:2.4}"
+export AJP_HTTPD_IMAGE="${AJP_HTTPD_IMAGE:-ghcr.io/wheels-dev/mirror/httpd:2.4}"
 GEN="$(mktemp -d "${TMPDIR:-/tmp}/wheels-ajp.XXXXXX")"
 export AJP_SERVER_JSON="$GEN/server-ajp.json"
 export AJP_HTTPD_CONF="$GEN/httpd.conf"
diff --git a/tools/distribution-drafts/linux-packages/rpm-rewrap.sh b/tools/distribution-drafts/linux-packages/rpm-rewrap.sh
index d8670f817f..508c4a63d6 100644
--- a/tools/distribution-drafts/linux-packages/rpm-rewrap.sh
+++ b/tools/distribution-drafts/linux-packages/rpm-rewrap.sh
@@ -25,8 +25,8 @@ set -euo pipefail
 
 IN="${1:?usage: rpm-rewrap.sh <nfpm.rpm> <out.rpm>}"
 OUT="${2:?usage: rpm-rewrap.sh <nfpm.rpm> <out.rpm>}"
-BUILD_IMAGE="${RPM_REWRAP_BUILD_IMAGE:-rockylinux/rockylinux:9}"
-CHECK_IMAGES="${RPM_REWRAP_CHECK_IMAGES:-rockylinux/rockylinux:10 rockylinux/rockylinux:9}"
+BUILD_IMAGE="${RPM_REWRAP_BUILD_IMAGE:-ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:9}"
+CHECK_IMAGES="${RPM_REWRAP_CHECK_IMAGES:-ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:10 ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:9}"
 
 IN_ABS="$(cd "$(dirname "${IN}")" && pwd)/$(basename "${IN}")"
 OUT_DIR_ABS="$(mkdir -p "$(dirname "${OUT}")" && cd "$(dirname "${OUT}")" && pwd)"
diff --git a/tools/docker/adobe2018/Dockerfile b/tools/docker/adobe2018/Dockerfile
index 3190079ab4..98350712b9 100644
--- a/tools/docker/adobe2018/Dockerfile
+++ b/tools/docker/adobe2018/Dockerfile
@@ -1,4 +1,4 @@
-FROM ortussolutions/commandbox:latest
+FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest
 
 LABEL maintainer "Wheels Core Team"
 
diff --git a/tools/docker/adobe2021/Dockerfile b/tools/docker/adobe2021/Dockerfile
index 14a4d336cc..d27e73b15a 100644
--- a/tools/docker/adobe2021/Dockerfile
+++ b/tools/docker/adobe2021/Dockerfile
@@ -1,4 +1,4 @@
-FROM ortussolutions/commandbox:latest
+FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest
 
 LABEL maintainer "Wheels Core Team"
 
diff --git a/tools/docker/adobe2023/Dockerfile b/tools/docker/adobe2023/Dockerfile
index a7b5e7a5d8..49a38e077c 100644
--- a/tools/docker/adobe2023/Dockerfile
+++ b/tools/docker/adobe2023/Dockerfile
@@ -1,4 +1,4 @@
-FROM ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0
+FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0
 
 LABEL maintainer "Wheels Core Team"
 
diff --git a/tools/docker/adobe2025/Dockerfile b/tools/docker/adobe2025/Dockerfile
index ca1d401734..1b6d114c96 100644
--- a/tools/docker/adobe2025/Dockerfile
+++ b/tools/docker/adobe2025/Dockerfile
@@ -1,4 +1,4 @@
-FROM ortussolutions/commandbox:jdk21@sha256:d65126caeb6c80c115d4cc93f9b9db88697c4fe2aa4ca83ea9a36dadc62c02c1
+FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:jdk21@sha256:d65126caeb6c80c115d4cc93f9b9db88697c4fe2aa4ca83ea9a36dadc62c02c1
 
 LABEL maintainer "Wheels Core Team"
 
diff --git a/tools/docker/boxlang/Dockerfile b/tools/docker/boxlang/Dockerfile
index 34c1812610..b63db1f50e 100644
--- a/tools/docker/boxlang/Dockerfile
+++ b/tools/docker/boxlang/Dockerfile
@@ -1,4 +1,4 @@
-FROM ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0
+FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0
 
 LABEL maintainer "Wheels Core Team"
 
diff --git a/tools/docker/lucee5/Dockerfile b/tools/docker/lucee5/Dockerfile
index 5be33428ed..20a9ae93ae 100644
--- a/tools/docker/lucee5/Dockerfile
+++ b/tools/docker/lucee5/Dockerfile
@@ -1,4 +1,4 @@
-FROM ortussolutions/commandbox:latest
+FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest
 
 LABEL maintainer "Wheels Core Team"
 
diff --git a/tools/docker/lucee6/Dockerfile b/tools/docker/lucee6/Dockerfile
index e6d903a1c5..f9e053b0bf 100644
--- a/tools/docker/lucee6/Dockerfile
+++ b/tools/docker/lucee6/Dockerfile
@@ -1,4 +1,4 @@
-FROM ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0
+FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0
 
 LABEL maintainer "Wheels Core Team"
 
diff --git a/tools/docker/lucee7/Dockerfile b/tools/docker/lucee7/Dockerfile
index 4fbb6f5223..b136cd7247 100644
--- a/tools/docker/lucee7/Dockerfile
+++ b/tools/docker/lucee7/Dockerfile
@@ -1,4 +1,4 @@
-FROM ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0
+FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0
 
 LABEL maintainer "Wheels Core Team"