diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 83c32e3..f4644d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,20 +34,19 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: registry.pumppi.dev
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
       - uses: docker/build-push-action@v6
         with:
           push: true
           tags: |
-            ghcr.io/${{ github.repository_owner }}/wasab:latest
-            ghcr.io/${{ github.repository_owner }}/wasab:${{ github.sha }}
+            registry.pumppi.dev/wasab:latest
+            registry.pumppi.dev/wasab:${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
diff --git a/README.md b/README.md
index 1f898ef..d48545e 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ in `src/apps.test.ts`, which is there so a removed or mistyped app is noticed.
 
 ## Deploy
 
-Pushing to `main` runs CI and publishes `ghcr.io/iritmaximus/wasab:latest`. Argo CD image-updater
+Pushing to `main` runs CI and publishes `registry.pumppi.dev/wasab:latest`. Argo CD image-updater
 picks up the new digest and rolls out `k8s-pumppi/wasab`. The container serves on port 8080 with a
 `/health` endpoint for probes.