diff --git a/.github/workflows/ghcr.yaml b/.github/workflows/ghcr.yaml
new file mode 100644
index 0000000..ea5e663
--- /dev/null
+++ b/.github/workflows/ghcr.yaml
@@ -0,0 +1,39 @@
+# Adopted from https://github.com/docker/metadata-action/tree/v3.3.0#basic
+# (Apache License 2.0)
+name: GHCR
+
+on:
+  push:
+    branches:
+      - 'master'
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - 'master'
+
+jobs:
+  ghcr:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v3
+        with:
+          images: ghcr.io/${{ github.repository }}
+      - name: Login to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index c7eb59a..ca55be3 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -23,9 +23,9 @@ jobs:
         make clean
         docker builder prune -a -f
     - name: "Smoke test (containerd, w/o cgroups)"
-      run: ./hack/smoketest-docker.sh u7s-test-containerd rootlesscontainers/usernetes --cri=containerd
+      run: ./hack/smoketest-docker.sh u7s-test-containerd ghcr.io/rootless-containers/usernetes --cri=containerd
     - name: "Smoke test (CRI-O, w/o cgroups)"
-      run: ./hack/smoketest-docker.sh u7s-test-crio rootlesscontainers/usernetes --cri=crio
+      run: ./hack/smoketest-docker.sh u7s-test-crio ghcr.io/rootless-containers/usernetes --cri=crio
     - name: "Smoke test (multi-node cluster with Flannel)"
       run: ./hack/smoketest-docker-compose.sh
   fedora:
diff --git a/Makefile b/Makefile
index 56adef5..c8f6f11 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # targets prefixed with underscore are not intended be invoked by human
 
 .DEFAULT_GOAL := binaries
-IMAGE=rootlesscontainers/usernetes
+IMAGE=ghcr.io/rootless-containers/usernetes
 
 binaries: image _binaries
 
diff --git a/README.md b/README.md
index 2cad1e6..51a263a 100644
--- a/README.md
+++ b/README.md
@@ -225,12 +225,15 @@ $ eval $(./show-cleanup-command.sh)
 
 ## Run Usernetes in Docker
 
-All-in-one Docker image is available as [`rootlesscontainers/usernetes`](https://hub.docker.com/r/rootlesscontainers/usernetes) on Docker Hub.
+All-in-one Docker image is available as [`ghcr.io/rootless-containers/usernetes`](https://ghcr.io/rootless-containers/usernetes) on GHCR.
+
+:warning: [`rootlesscontainers/usernetes`](https://hub.docker.com/r/rootlesscontainers/usernetes) on Docker Hub is no longer updated.
+Please use the GHCR image.
 
 To build the image manually:
 
 ```console
-$ docker build -t rootlesscontainers/usernetes .
+$ docker build -t ghcr.io/rootless-containers/usernetes .
 ```
 
 The image is based on Fedora.
@@ -238,7 +241,7 @@ The image is based on Fedora.
 ### Single node
 
 ```console
-$ docker run -td --name usernetes-node -p 127.0.0.1:6443:6443 --privileged rootlesscontainers/usernetes --cri=containerd
+$ docker run -td --name usernetes-node -p 127.0.0.1:6443:6443 --privileged ghcr.io/rootless-containers/usernetes --cri=containerd
 ```
 
 Wait until `docker ps` shows "healty" as the status of `usernetes-node` container.
diff --git a/docker-compose.yml b/docker-compose.yml
index d5a64a3..27e2f2c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,7 +2,7 @@ version: "3"
 
 services:
   init-certs:
-    image: rootlesscontainers/usernetes
+    image: ghcr.io/rootless-containers/usernetes
     entrypoint: /docker-entrypoint.sh
     command:
       - unsudo
@@ -19,7 +19,7 @@ services:
       - tls-node-crio:/home/user/.config/usernetes/nodes.node-crio
       - tls-node-containerd:/home/user/.config/usernetes/nodes.node-containerd
   master:
-    image: rootlesscontainers/usernetes
+    image: ghcr.io/rootless-containers/usernetes
     command:
       - --wait-init-certs
       - --start=u7s-master-with-etcd.target
@@ -39,7 +39,7 @@ services:
     volumes:
       - tls-master:/home/user/.config/usernetes/master
   node-crio:
-    image: rootlesscontainers/usernetes
+    image: ghcr.io/rootless-containers/usernetes
     command:
       - --wait-init-certs
       - --start=u7s-node.target
@@ -60,7 +60,7 @@ services:
 # (currently required because master and flanneld share the same etcd cluster)
       - tls-master:/home/user/.config/usernetes/master
   node-containerd:
-    image: rootlesscontainers/usernetes
+    image: ghcr.io/rootless-containers/usernetes
     command:
       - --wait-init-certs
       - --start=u7s-node.target
diff --git a/hack/smoketest-docker.sh b/hack/smoketest-docker.sh
index 9e6b170..97f62c6 100755
--- a/hack/smoketest-docker.sh
+++ b/hack/smoketest-docker.sh
@@ -14,7 +14,7 @@ args=$@
 
 set -x
 tmpdir=$(mktemp -d)
-docker run -td --name $container -p 127.0.0.1:6443:6443 --privileged rootlesscontainers/usernetes $args
+docker run -td --name $container -p 127.0.0.1:6443:6443 --privileged ghcr.io/rootless-containers/usernetes $args
 function cleanup() {
 	docker rm -f $container
 	rm -rf $tmpdir