diff --git a/.github/workflows/build-builder.yml b/.github/workflows/build-builder.yml
index 07db6561586..10093fae5db 100644
--- a/.github/workflows/build-builder.yml
+++ b/.github/workflows/build-builder.yml
@@ -15,27 +15,44 @@
 # limitations under the License.
 #
 
+# Publishes the CI toolchain image from devops/docker/lake-builder.
+# Push a tag `builder-vX.Y.Z` to publish `<owner>/devlake:lake-builder-vX.Y.Z`
+# (see devops/docker/lake-builder/README.md). It uses the same Docker Hub
+# credentials as build.yml. No moving `latest` tag is pushed: workflows pin
+# an explicit version.
 name: Build-BuilderImage-Push-Docker
+env:
+  DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USER }}
+  DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
 on:
   push:
     tags:
-    - 'builder-*'
+      - 'builder-v*'
+permissions:
+  contents: read
 jobs:
-  build-lake:
-    name: Build lake-builder image
+  build-lake-builder:
+    name: Build and push lake-builder image
+    if: github.repository == 'apache/devlake'
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v7
-    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-      with:
-        username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
-        password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
-    - name: Build lake image
-      run: |
-        cd devops/docker/lake-builder/
-        export IMAGE_LAKE=mericodev/lake-builder
-        export IMAGE_VER=${GITHUB_REF:18}
-        docker build -t $IMAGE_LAKE:latest --file ./Dockerfile .
-        docker tag $IMAGE_LAKE:latest $IMAGE_LAKE:$IMAGE_VER
-        docker push $IMAGE_LAKE:$IMAGE_VER
-        docker push $IMAGE_LAKE:latest
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Compute image tag
+        id: meta
+        run: echo "tag=lake-builder-${GITHUB_REF_NAME#builder-}" >> "$GITHUB_OUTPUT"
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
+      - name: Login to DockerHub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+        with:
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ env.DOCKERHUB_TOKEN }}
+      - name: Build and push lake-builder image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
+        with:
+          context: devops/docker/lake-builder
+          push: true
+          tags: ${{ secrets.DOCKERHUB_OWNER }}/devlake:${{ steps.meta.outputs.tag }}
+          platforms: linux/amd64
diff --git a/devops/docker/lake-builder/README.md b/devops/docker/lake-builder/README.md
index 177699d7c27..de0c0004897 100644
--- a/devops/docker/lake-builder/README.md
+++ b/devops/docker/lake-builder/README.md
@@ -18,18 +18,14 @@ limitations under the License.
 
 Golang builder image for DevLake. Used by GitHub workflows.
 
-https://hub.docker.com/r/mericodev/lake-builder
-
-## Manual Release
-
-```shell
-export VERSION=0.0.11
-docker build -t mericodev/lake-builder:$VERSION .
-docker push mericodev/lake-builder:$VERSION
-```
+Published as `apache/devlake:lake-builder-v#.#.#`
+(https://hub.docker.com/r/apache/devlake/tags?name=lake-builder).
+Earlier versions (up to v0.0.15) were published as `mericodev/lake-builder`.
 
 ## Tagged Release
-1. Create a tag matching the pattern `builder-v#.#.#`, e.g. `builder-v0.0.11`. Determine the previous tag first so you version
-it correctly. Example command: `git tag builder-v0.0.11`
-2. Push the tag to origin. Example command: `git push origin --tag builder-v0.0.11`
-3. Done! This will trigger a GitHub workflow that will push this image to the Docker registry.
\ No newline at end of file
+1. Create a tag matching the pattern `builder-v#.#.#`, e.g. `builder-v0.0.16`. Determine the previous tag first so you version
+it correctly. Example command: `git tag builder-v0.0.16`
+2. Push the tag to origin. Example command: `git push origin builder-v0.0.16`
+3. The `Build-BuilderImage-Push-Docker` workflow (`.github/workflows/build-builder.yml`) builds this directory and pushes
+`apache/devlake:lake-builder-v0.0.16`.
+4. Point the `container:` lines in `.github/workflows/` to the new tag in a follow-up PR.