diff --git a/.github/workflows/build-test-and-push-windows-image.yml b/.github/workflows/build-test-and-push-windows-image.yml
index 368016d3..9d8b7f2a 100644
--- a/.github/workflows/build-test-and-push-windows-image.yml
+++ b/.github/workflows/build-test-and-push-windows-image.yml
@@ -39,6 +39,8 @@ jobs:
       - name: Checkout ${{ github.repository }}
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -67,11 +69,22 @@ jobs:
           tag=${tag_without_os}-${INPUT_OS}${MATRIX_EDITION}
           EOF
 
-      - name: Login to Docker Hub
+      # https://github.com/actions/runner-images/issues/13729
+      - if: runner.environment != 'self-hosted'
+        name: Ensure Docker Engine is running
+        shell: powershell
+        run: |
+          $dockerState = Get-Service -Name docker
+          if ($dockerState.Status -ne 'Running') {
+            Start-Service -Name docker
+          }
+
+      - name: Login to container registry
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
-          username: ${{ secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER }}
-          password: ${{ secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
+          registry: ${{ case(startsWith(inputs.repo, 'ghcr.io/'), 'ghcr.io', 'docker.io') }}
+          username: ${{ case(startsWith(inputs.repo, 'ghcr.io/'), github.actor, secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER) }}
+          password: ${{ case(startsWith(inputs.repo, 'ghcr.io/'), github.token, secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN) }}
 
       - name: Build ${{ steps.info.outputs.tag }}
         uses: ./.github/actions/build-windows-image
diff --git a/.github/workflows/release-windows.yml b/.github/workflows/release-windows.yml
index 53fa85bb..e853a12c 100644
--- a/.github/workflows/release-windows.yml
+++ b/.github/workflows/release-windows.yml
@@ -5,7 +5,19 @@ concurrency:
   cancel-in-progress: true
 
 on:
+  workflow_call:
+    inputs:
+      repo:
+        description: Image repository to publish to
+        required: true
+        type: string
   workflow_dispatch:
+    inputs:
+      repo:
+        description: Image repository to publish to (defaults to Docker Hub)
+        required: false
+        default: ""
+        type: string
 
 permissions: {}
 
@@ -22,6 +34,8 @@ jobs:
       - name: Checkout ${{ github.repository }}
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -37,6 +51,7 @@ jobs:
     needs: image-matrix
     permissions:
       contents: read
+      packages: write
     secrets: inherit  # zizmor: ignore[secrets-inherit]
     uses: ./.github/workflows/build-test-and-push-windows-image.yml
     strategy:
@@ -47,4 +62,4 @@ jobs:
       os: "${{ matrix.os }}"
       features: "${{ toJSON(matrix.features) }}"
       container_env: "${{ toJSON(matrix.env) }}"
-      repo: "${{ vars.DOCKERHUB_REPOSITORY || github.repository }}"
+      repo: "${{ inputs.repo || vars.DOCKERHUB_REPOSITORY || github.repository }}"