diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 32a98a416..3c6b5595d 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -5,10 +5,17 @@ on:
     types: [published]
   workflow_dispatch:
 
+env:
+  REGISTRY: ghcr.io
+
 jobs:
   push_to_registry:
-    name: Push Docker image to Docker Hub
+    name: Push Docker image to GHCR
     runs-on: ubuntu-latest
+    if: github.repository == 'transfem-org/Sharkey'
+    permissions:
+      contents: read
+      packages: write
 
     steps:
       - name: Check out the repo
@@ -17,12 +24,12 @@ jobs:
         id: buildx
         uses: docker/setup-buildx-action@v3.0.0
         with:
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: misskey/misskey
+          images: ${{ env.REGISTRY }}/transfem-org/sharkey
           tags: |
             type=edge
             type=ref,event=pr
@@ -30,12 +37,13 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-      - name: Log in to Docker Hub
+      - name: Log in to GHCR
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build and Push to Docker Hub
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and Push to GHCR
         uses: docker/build-push-action@v5
         with:
           builder: ${{ steps.buildx.outputs.name }}
@@ -43,7 +51,7 @@ jobs:
           push: true
           platforms: ${{ steps.buildx.outputs.platforms }}
           provenance: false
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ env.REGISTRY }}/transfem-org/sharkey:stable
+          labels: stable
           cache-from: type=gha
           cache-to: type=gha,mode=max