diff --git a/stacks/android-emulator/main.tf b/stacks/android-emulator/main.tf
index 5378ad20..8ca67428 100644
--- a/stacks/android-emulator/main.tf
+++ b/stacks/android-emulator/main.tf
@@ -101,7 +101,7 @@ resource "kubernetes_deployment" "android-emulator" {
         }
         container {
           name  = "emulator"
-          image = "forgejo.viktorbarzin.me/viktor/android-emulator:${var.image_tag}"
+          image = "ghcr.io/viktorbarzin/android-emulator:${var.image_tag}"
 
           security_context {
             privileged = true # /dev/kvm access
diff --git a/stacks/android-emulator/variables.tf b/stacks/android-emulator/variables.tf
index 71a6bedd..bcc24a0d 100644
--- a/stacks/android-emulator/variables.tf
+++ b/stacks/android-emulator/variables.tf
@@ -5,6 +5,6 @@ variable "tls_secret_name" {
 
 variable "image_tag" {
   type        = string
-  default     = "api36-v8"
-  description = "android-emulator image tag at forgejo.viktorbarzin.me/viktor/android-emulator. Built + pushed manually from stacks/android-emulator/docker/ (see README.md) — bump this when the image is rebuilt."
+  default     = "latest"
+  description = "android-emulator image tag at forgejo.viktorbarzin.me/viktor/android-emulator. Built by GHA (.github/workflows/build-android-emulator.yml) -> ghcr.io/viktorbarzin/android-emulator on changes to stacks/android-emulator/docker/ (ADR-0002). :latest tracks the newest build."
 }
diff --git a/stacks/chrome-service/main.tf b/stacks/chrome-service/main.tf
index 7a063bb6..944c880f 100644
--- a/stacks/chrome-service/main.tf
+++ b/stacks/chrome-service/main.tf
@@ -324,7 +324,7 @@ resource "kubernetes_deployment" "chrome_service" {
         container {
           name = "novnc"
           # Phase 3 cutover 2026-05-07 — Forgejo registry consolidation.
-          image             = "forgejo.viktorbarzin.me/viktor/chrome-service-novnc:v4"
+          image             = "ghcr.io/viktorbarzin/chrome-service-novnc:latest"
           image_pull_policy = "IfNotPresent"
           port {
             name           = "http"