diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0531369..9870146 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,6 +8,10 @@ jobs:
     name: Docker
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      packages: write
+
     strategy:
       fail-fast: false
       matrix:
@@ -17,7 +21,7 @@ jobs:
           - docworker-lambda
 
     env:
-      PUBLIC_IMAGE_PREFIX: 'datastewardshipwizard'
+      PUBLIC_IMAGE_PREFIX: 'ghcr.io/ds-wizard'
       IMAGE_BASE_NAME: 'python-base'
       DOCKER_META_CONTEXT: '.'
       DOCKER_META_FILE: './${{ matrix.tag }}/Dockerfile'
@@ -63,13 +67,14 @@ jobs:
         cache-from: type=gha
         cache-to: type=gha,mode=max
 
-    # PUBLIC: DOCKER HUB
+    # PUBLIC: GITHUB CONTAINER REGISTRY
     - name: Docker login [public]
       if: github.event_name != 'pull_request'
       uses: docker/login-action@v4
       with:
-        username: ${{ secrets.DOCKER_HUB_USERNAME }}
-        password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Docker meta [public]
       id: meta-public