diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 917cc45..57f101b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,10 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   docker-base:
     runs-on: ubuntu-latest
@@ -22,7 +26,7 @@ jobs:
         uses: docker/metadata-action@v5
         id: meta
         with:
-          images: clux/controller
+          images: ghcr.io/${{ github.repository_owner }}/controller
           tags: |
             type=pep440,pattern={{version}}
             type=raw,value=latest,enable={{is_default_branch}}
@@ -32,8 +36,9 @@ jobs:
         uses: docker/login-action@v3
         if: github.event_name != 'pull_request'
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: actions/cache@v4
         with:
@@ -94,7 +99,7 @@ jobs:
         uses: docker/metadata-action@v5
         id: meta
         with:
-          images: clux/controller
+          images: ghcr.io/${{ github.repository_owner }}/controller
           tags: |
             type=pep440,pattern={{version}},prefix=otel-
             type=raw,value=otel,enable={{is_default_branch}}
@@ -124,8 +129,9 @@ jobs:
         uses: docker/login-action@v3
         if: github.event_name != 'pull_request'
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Docker buildx and push with telemetry
         uses: docker/build-push-action@v6
@@ -201,7 +207,7 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - uses: nolar/setup-k3d-k3s@v1
         with:
-          version: v1.25
+          version: v1.31
           k3d-name: kube
           k3d-args: "--no-lb --no-rollback --k3s-arg --disable=traefik,servicelb,metrics-server@server:*"
 
@@ -211,7 +217,7 @@ jobs:
         run: cargo run --bin crdgen | kubectl apply -f -
       - name: Run all default features integration library tests
         run: cargo test --lib --all -- --ignored
- 
+
   unit:
     runs-on: ubuntu-latest
     steps:
diff --git a/README.md b/README.md
index d2058ee..df89c18 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,5 @@
 ## controller-rs
 [![ci](https://github.com/kube-rs/controller-rs/actions/workflows/ci.yml/badge.svg)](https://github.com/kube-rs/controller-rs/actions/workflows/ci.yml)
-[![docker image](https://img.shields.io/docker/pulls/clux/controller.svg)](
-https://hub.docker.com/r/clux/controller/tags/)
 
 A rust kubernetes reference controller for a [`Document` resource](https://github.com/kube-rs/controller-rs/blob/main/yaml/crd.yaml) using [kube](https://github.com/kube-rs/kube/), with observability instrumentation.
 
@@ -26,6 +24,8 @@ kubectl wait --for=condition=available deploy/doc-controller --timeout=30s
 kubectl port-forward service/doc-controller 8080:80
 ```
 
+The helm chart sets up the [container](https://github.com/kube-rs/controller-rs/pkgs/container/controller) built from this repository.
+
 ### Opentelemetry
 
 Build and run with `telemetry` feature, or configure it via `helm`:
diff --git a/charts/doc-controller/values.yaml b/charts/doc-controller/values.yaml
index fb36701..5beef84 100644
--- a/charts/doc-controller/values.yaml
+++ b/charts/doc-controller/values.yaml
@@ -4,7 +4,7 @@ namespace: "default"
 version: "" # pin a specific version
 
 image:
-  repository: clux/controller
+  repository: ghcr.io/kube-rs/controller
   pullPolicy: IfNotPresent
 
 imagePullSecrets: []
diff --git a/yaml/deployment.yaml b/yaml/deployment.yaml
index 615819b..c2cb610 100644
--- a/yaml/deployment.yaml
+++ b/yaml/deployment.yaml
@@ -139,7 +139,7 @@ spec:
         {}
       containers:
       - name: doc-controller
-        image: clux/controller:0.15.0
+        image: ghcr.io/kube-rs/controller:0.15.0
         imagePullPolicy: IfNotPresent
         securityContext:
           {}