diff --git a/bazel/container_images.bzl b/bazel/container_images.bzl
index f0778e122e4..435336460be 100644
--- a/bazel/container_images.bzl
+++ b/bazel/container_images.bzl
@@ -159,11 +159,12 @@ def stirling_test_images():
     )
 
     # Curl container, for OpenSSL tracing tests.
-    # curlimages/curl:7.74.0
+    # curlimages/curl:7.87.0
+    # multiarch sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
     _container_image(
         name = "curl_base_image",
-        repository = "curlimages/curl",
-        digest = "sha256:5594e102d5da87f8a3a6b16e5e9b0e40292b5404c12f9b6962fd6b056d2a4f82",
+        repository = "pixie-oss-pixie-dev-public-curl",
+        digest = "sha256:4311823d3576c0b7330beccbe09896ff0378c9c1c6f6974ff9064af803fed766",
     )
 
     # Ruby container, for OpenSSL tracing tests.
diff --git a/demos/sock-shop/sock-shop-loadgen.yaml b/demos/sock-shop/sock-shop-loadgen.yaml
index 0967c9106ac..a323d3452fd 100644
--- a/demos/sock-shop/sock-shop-loadgen.yaml
+++ b/demos/sock-shop/sock-shop-loadgen.yaml
@@ -28,7 +28,7 @@ spec:
 
       initContainers:
       - name: wait-sock-shop
-        image: ghcr.io/pixie-io/px-sock-shop-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -x;
           until timeout 2 curl -f "${SOCK_SHOP_HEALTH_ADDR}"; do
             echo "waiting for ${SOCK_SHOP_HEALTH_ADDR}";
diff --git a/k8s/cloud/base/ory_auth/kratos/kratos_deployment.yaml b/k8s/cloud/base/ory_auth/kratos/kratos_deployment.yaml
index e42f128d6b5..2a5a6e8907a 100644
--- a/k8s/cloud/base/ory_auth/kratos/kratos_deployment.yaml
+++ b/k8s/cloud/base/ory_auth/kratos/kratos_deployment.yaml
@@ -157,7 +157,7 @@ spec:
       - name: admin-create-if-not-exists
         imagePullPolicy: IfNotPresent
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -x;
           URL="${ADMIN_URL}/admin/health/ready";
           until [ $(curl -k -m 0.5 -s -o /dev/null -w "%{http_code}" ${URL}) -eq 200 ]; do
diff --git a/k8s/devinfra/buildbuddy-executor/values.yaml b/k8s/devinfra/buildbuddy-executor/values.yaml
index 29f57ac773f..b10c184d49f 100644
--- a/k8s/devinfra/buildbuddy-executor/values.yaml
+++ b/k8s/devinfra/buildbuddy-executor/values.yaml
@@ -18,7 +18,7 @@ config:
 extraInitContainers:
 - name: download-executor
   # yamllint disable-line rule:line-length
-  image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+  image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
   # yamllint disable rule:line-length
   command: ['sh', '-c', 'set -e;
     curl -fsSL https://github.com/buildbuddy-io/buildbuddy/releases/download/v2.12.42/executor-enterprise-linux-amd64 > /bb-executor/executor;
diff --git a/k8s/vizier/base/kelvin_deployment.yaml b/k8s/vizier/base/kelvin_deployment.yaml
index e412f7cdf58..8d5edbbbada 100644
--- a/k8s/vizier/base/kelvin_deployment.yaml
+++ b/k8s/vizier/base/kelvin_deployment.yaml
@@ -34,7 +34,7 @@ spec:
       initContainers:
       - name: qb-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -x;
           URL="https://${SERVICE_NAME}:${SERVICE_PORT}/healthz";
           until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
diff --git a/k8s/vizier/base/patch_sentry.yaml b/k8s/vizier/base/patch_sentry.yaml
index 82d4f899512..16eba74b58c 100644
--- a/k8s/vizier/base/patch_sentry.yaml
+++ b/k8s/vizier/base/patch_sentry.yaml
@@ -9,7 +9,7 @@ spec:
       initContainers:
       - name: cc-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -x;
           URL="https://${SERVICE_NAME}:${SERVICE_PORT}/readyz";
           until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
diff --git a/k8s/vizier/base/query_broker_deployment.yaml b/k8s/vizier/base/query_broker_deployment.yaml
index a8157d30ee7..d7ede16caf0 100644
--- a/k8s/vizier/base/query_broker_deployment.yaml
+++ b/k8s/vizier/base/query_broker_deployment.yaml
@@ -38,7 +38,7 @@ spec:
       initContainers:
       - name: mds-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -x;
           URL="https://${SERVICE_NAME}:${SERVICE_PORT}/healthz";
           until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
diff --git a/k8s/vizier/bootstrap/cloud_connector_deployment.yaml b/k8s/vizier/bootstrap/cloud_connector_deployment.yaml
index 58bc63c6566..da510aa2f09 100644
--- a/k8s/vizier/bootstrap/cloud_connector_deployment.yaml
+++ b/k8s/vizier/bootstrap/cloud_connector_deployment.yaml
@@ -36,7 +36,7 @@ spec:
       initContainers:
       - name: nats-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -xe;
           URL="${PROTOCOL}://${SERVICE_NAME}:${SERVICE_PORT}${HEALTH_PATH}";
           until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
diff --git a/k8s/vizier/etcd_metadata/base/metadata_deployment.yaml b/k8s/vizier/etcd_metadata/base/metadata_deployment.yaml
index 9c7d2a9ec18..bb983463ade 100644
--- a/k8s/vizier/etcd_metadata/base/metadata_deployment.yaml
+++ b/k8s/vizier/etcd_metadata/base/metadata_deployment.yaml
@@ -39,7 +39,7 @@ spec:
       initContainers:
       - name: nats-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -xe;
           URL="${PROTOCOL}://${SERVICE_NAME}:${SERVICE_PORT}${HEALTH_PATH}";
           until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
@@ -57,7 +57,7 @@ spec:
           value: "http"
       - name: etcd-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         # yamllint disable rule:line-length
         command: ['sh', '-c', 'set -xe;
           ETCD_PATH="${PL_MD_ETCD_SERVER}";
diff --git a/k8s/vizier/pem/base/pem_daemonset.yaml b/k8s/vizier/pem/base/pem_daemonset.yaml
index ac1ab073ca6..6c4f89159c7 100644
--- a/k8s/vizier/pem/base/pem_daemonset.yaml
+++ b/k8s/vizier/pem/base/pem_daemonset.yaml
@@ -45,7 +45,7 @@ spec:
       initContainers:
       - name: qb-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -x;
           URL="https://${SERVICE_NAME}:${SERVICE_PORT}/healthz";
           until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
diff --git a/k8s/vizier/persistent_metadata/base/metadata_statefulset.yaml b/k8s/vizier/persistent_metadata/base/metadata_statefulset.yaml
index 4b89d228a62..14198b40ade 100644
--- a/k8s/vizier/persistent_metadata/base/metadata_statefulset.yaml
+++ b/k8s/vizier/persistent_metadata/base/metadata_statefulset.yaml
@@ -42,7 +42,7 @@ spec:
       initContainers:
       - name: nats-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -xe;
           URL="${PROTOCOL}://${SERVICE_NAME}:${SERVICE_PORT}${HEALTH_PATH}";
           until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
diff --git a/k8s/vizier/sanitizer/kelvin_deployment.yaml b/k8s/vizier/sanitizer/kelvin_deployment.yaml
index d73e6252b95..8d02f1f9d4a 100644
--- a/k8s/vizier/sanitizer/kelvin_deployment.yaml
+++ b/k8s/vizier/sanitizer/kelvin_deployment.yaml
@@ -15,7 +15,7 @@ spec:
       initContainers:
       - name: qb-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         command: ['sh', '-c', 'set -x;
           URL="https://${SERVICE_NAME}:${SERVICE_PORT}/healthz";
           until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
diff --git a/src/e2e_test/jetstream_loadtest/k8s/subscriber_deployment.yaml b/src/e2e_test/jetstream_loadtest/k8s/subscriber_deployment.yaml
index c576a5fabad..35bcb944e21 100644
--- a/src/e2e_test/jetstream_loadtest/k8s/subscriber_deployment.yaml
+++ b/src/e2e_test/jetstream_loadtest/k8s/subscriber_deployment.yaml
@@ -20,7 +20,7 @@ spec:
       initContainers:
       - name: wait-for-publisher
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         # yamllint disable rule:line-length
         command: ['sh', '-c', 'set -xe;
           URL="http://jetstream-publisher.${NS}.svc.cluster.local:8080/metrics";
diff --git a/src/e2e_test/protocol_loadtest/http/wrk/k8s/client_deployment.yaml b/src/e2e_test/protocol_loadtest/http/wrk/k8s/client_deployment.yaml
index f909cff9324..3ff0a392fb8 100644
--- a/src/e2e_test/protocol_loadtest/http/wrk/k8s/client_deployment.yaml
+++ b/src/e2e_test/protocol_loadtest/http/wrk/k8s/client_deployment.yaml
@@ -29,7 +29,7 @@ spec:
       initContainers:
       - name: server-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         # yamllint disable rule:line-length
         command: ['sh', '-c', 'set -xe;
           URL="${PROTOCOL}://${SERVICE_NAME}:${SERVICE_PORT}${HEALTH_PATH}";
diff --git a/src/e2e_test/protocol_loadtest/k8s/client/client_deployment.yaml b/src/e2e_test/protocol_loadtest/k8s/client/client_deployment.yaml
index f96e8a0ec10..eb2ad3468e2 100644
--- a/src/e2e_test/protocol_loadtest/k8s/client/client_deployment.yaml
+++ b/src/e2e_test/protocol_loadtest/k8s/client/client_deployment.yaml
@@ -17,7 +17,7 @@ spec:
       initContainers:
       - name: server-wait
         # yamllint disable-line rule:line-length
-        image: gcr.io/pixie-oss/pixie-dev-public/curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
+        image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
         # yamllint disable rule:line-length
         command: ['sh', '-c', 'set -xe;
           URL="http://${SERVICE_NAME}:${SERVICE_PORT}/";