diff --git a/.github/workflows/publish-musl-toolchain.yml b/.github/workflows/publish-musl-toolchain.yml
new file mode 100644
index 00000000..634fc73d
--- /dev/null
+++ b/.github/workflows/publish-musl-toolchain.yml
@@ -0,0 +1,52 @@
+name: Publish musl toolchain to GHCR
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - .gitlab/common.yml
+      - .github/workflows/publish-musl-toolchain.yml
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - name: Login to GHCR
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Install crane
+        shell: bash
+        run: |
+          archive="$RUNNER_TEMP/go-containerregistry_Linux_x86_64.tar.gz"
+          curl -fsSL \
+            https://github.com/google/go-containerregistry/releases/download/v0.20.3/go-containerregistry_Linux_x86_64.tar.gz \
+            -o "$archive"
+          printf '%s  %s\n' \
+            36c67a932f489b3f2724b64af90b599a8ef2aa7b004872597373c0ad694dc059 \
+            "$archive" | sha256sum -c -
+          tar -xzf "$archive" -C "$RUNNER_TEMP" crane
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+      - name: Copy pinned toolchain
+        shell: bash
+        run: |
+          digest=$(sed -n 's/^  MUSL_TOOLCHAIN_IMAGE_DIGEST: "\([^"]*\)".*$/\1/p' .gitlab/common.yml)
+          test -n "$digest"
+          source="public.ecr.aws/datadog/musl-build-env@$digest"
+          mirror="ghcr.io/datadog/nginx-datadog/musl-build-env:${digest/:/-}"
+          if existing=$(crane digest "$mirror" 2>/dev/null); then
+            test "$existing" = "$digest"
+          else
+            crane copy "$source" "$mirror"
+          fi
+          test "$(crane digest "$mirror")" = "$digest"
+          echo "Published $mirror@$digest"
diff --git a/.github/workflows/system-tests.yml b/.github/workflows/system-tests.yml
index bb9426d3..edbf685e 100644
--- a/.github/workflows/system-tests.yml
+++ b/.github/workflows/system-tests.yml
@@ -12,6 +12,9 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     env:
       ARCH: x86_64
       # The Nginx version must match the one in System Tests, in
@@ -29,6 +32,24 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GHCR
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Select musl toolchain image
+        shell: bash
+        run: |
+          digest=$(sed -n 's/^  MUSL_TOOLCHAIN_IMAGE_DIGEST: "\([^"]*\)".*$/\1/p' .gitlab/common.yml)
+          test -n "$digest"
+          mirror="ghcr.io/datadog/nginx-datadog/musl-build-env@$digest"
+          if docker manifest inspect "$mirror" >/dev/null 2>&1; then
+            echo "MUSL_TOOLCHAIN_IMAGE=$mirror" >> "$GITHUB_ENV"
+          else
+            echo "::warning::GHCR toolchain image is unavailable; using public ECR"
+            echo "MUSL_TOOLCHAIN_IMAGE=public.ecr.aws/datadog/musl-build-env@$digest" >> "$GITHUB_ENV"
+          fi
       - name: build
         run: 'make build-musl'
         env: