diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 3f668384868..156a14d239b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -12,12 +12,15 @@ on:
       - 'v?[0-9]+.[0-9]+.[0-9]+'
 env:
   TEST_TAG: etherpad/etherpad:test
+
 permissions:
   contents: read
 
 jobs:
-  docker:
+  build-test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       PNPM_HOME: ~/.pnpm-store
     steps:
@@ -26,11 +29,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           path: etherpad
-
-      -
-        name: Set up QEMU
-        if: github.event_name == 'push'
-        uses: docker/setup-qemu-action@v4
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -78,13 +76,34 @@ jobs:
           done
           (cd src && gnpm run test-container)
           git clean -dxf .
+
+  publish:
+    needs: build-test
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      -
+        name: Check out
+        uses: actions/checkout@v6
+        with:
+          path: etherpad
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
       -
         name: Docker meta
-        if: github.event_name == 'push'
         id: meta
         uses: docker/metadata-action@v6
         with:
-          images: etherpad/etherpad
+          images: |
+            etherpad/etherpad
+            ghcr.io/ether/etherpad
           tags: |
             type=ref,event=branch
             type=semver,pattern={{version}}
@@ -92,15 +111,20 @@ jobs:
             type=semver,pattern={{major}}
       -
         name: Log in to Docker Hub
-        if: github.event_name == 'push'
         uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Build and push
         id: build-docker
-        if: github.event_name == 'push'
         uses: docker/build-push-action@v7
         with:
           context: ./etherpad
@@ -109,6 +133,7 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
       - name: Update repo description
         uses: peter-evans/dockerhub-description@v5
         if: github.ref == 'refs/heads/master'
@@ -118,8 +143,8 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           repository: etherpad/etherpad
           enable-url-completion: true
-      - name: Check out
-        if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+      - name: Check out ether-charts
+        if: github.ref == 'refs/heads/develop'
         uses: actions/checkout@v6
         with:
           path: ether-charts
diff --git a/README.md b/README.md
index 635ae688925..259dddc7980 100644
--- a/README.md
+++ b/README.md
@@ -103,11 +103,13 @@ $env:ETHERPAD_RUN=1; irm https://raw.githubusercontent.com/ether/etherpad/master
 
 ### Docker-Compose
 
+The official image is published to both Docker Hub (`etherpad/etherpad`) and GitHub Container Registry (`ghcr.io/ether/etherpad`) with identical tags. Use whichever suits your environment; GHCR avoids Docker Hub's anonymous pull rate limits.
+
 ```yaml
 services:
   app:
     user: "0:0"
-    image: etherpad/etherpad:latest
+    image: etherpad/etherpad:latest  # or: ghcr.io/ether/etherpad:latest
     tty: true
     stdin_open: true
     volumes:
diff --git a/doc/docker.md b/doc/docker.md
index 71af392360f..fe31ea031ab 100644
--- a/doc/docker.md
+++ b/doc/docker.md
@@ -1,15 +1,21 @@
 # Docker
 
-The official Docker image is available on https://hub.docker.com/r/etherpad/etherpad.
+The official Docker image is published to two registries with identical tags:
 
-## Downloading from Docker Hub
-If you are ok downloading a [prebuilt image from Docker Hub](https://hub.docker.com/r/etherpad/etherpad), these are the commands:
+- Docker Hub (canonical): https://hub.docker.com/r/etherpad/etherpad
+- GitHub Container Registry (mirror): https://github.com/ether/etherpad/pkgs/container/etherpad
+
+The GHCR mirror is useful if you are hitting Docker Hub anonymous pull rate limits (for example on Kubernetes clusters).
+
+## Downloading a prebuilt image
 ```bash
-# gets the latest published version
+# from Docker Hub
 docker pull etherpad/etherpad
-
-# gets a specific version
 docker pull etherpad/etherpad:2.6.1
+
+# from GHCR (same image, same tags)
+docker pull ghcr.io/ether/etherpad
+docker pull ghcr.io/ether/etherpad:2.6.1
 ```
 
 ## Build a personalized container