diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c553d25..7be2e37 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,62 +1,66 @@
 # CI Pipeline
-name: Build 
+name: Build
 
-on: 
-  push: 
+on:
+  push:
     branches:
       - "*"
-    tags: 
+    tags:
       - "*"
-
   pull_request:
     branches:
       - "*"
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   HELM_REPO_URL: https://eccr.ecmwf.int
   HELM_CHART: ${{ github.workspace }}/helm/gsprestapi
+
   HELM_REPO_USERNAME: ${{ secrets.HELM_REPO_USERNAME }}
   HELM_KEY_PASSPHRASE: ${{ secrets.HELM_KEY_PASSPHRASE }}
   HELM_REPO_PASSWORD: ${{ secrets.HELM_REPO_PASSWORD }}
-  CI_REGISTRY: docker.aquaveo.com
-  CI_REGISTRY_USER: ${{ secrets.CI_REGISTRY_USER }}
-  CI_REGISTRY_PASSWORD: ${{ secrets.CI_REGISTRY_PASSWORD }}
-  CI_REGISTRY_IMAGE: docker.aquaveo.com/tethys/gsprestapi
+
+  CI_REGISTRY: ghcr.io
+  CI_REGISTRY_IMAGE: ghcr.io/${{ github.repository }}
+
   CI_COMMIT_SHORT_SHA: ${{ github.sha }}
+
   ECCR_USER: ${{ secrets.ECCR_USER }}
   ECCR_PASSWORD: ${{ secrets.ECCR_PASSWORD }}
+
   KANIKO_IMAGE: gcr.io/kaniko-project/executor:debug
   KANIKO_CONTEXT: /workspace
   KANIKO_DOCKERFILE: Dockerfile
 
-
 jobs:
-  check-helm: 
-      name: Check Helm
-      runs-on: ubuntu-latest
-      steps:
-        - name: Checkout repository
-          uses: actions/checkout@v4
-          with:
-            submodules: false
-          
-        - name: Ensure HELM_CHART is set
-          run: |
-            if [[ -z "${HELM_CHART}" ]]; then
-              echo "HELM_CHART must be set" >&2
-              exit 1
-            fi
-
-        - name: Lint Helm Chart
-          run: helm lint $HELM_CHART
-
-        - name: Run Check Helm Script
-          run: |
-            chmod +x ./check_helm_chart
-            ./check_helm_chart $HELM_CHART
-
-
-  update-helm: 
+  check-helm:
+    name: Check Helm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: false
+
+      - name: Ensure HELM_CHART is set
+        run: |
+          if [[ -z "${HELM_CHART}" ]]; then
+            echo "HELM_CHART must be set" >&2
+            exit 1
+          fi
+
+      - name: Lint Helm Chart
+        run: helm lint "$HELM_CHART"
+
+      - name: Run Check Helm Script
+        run: |
+          chmod +x ./check_helm_chart
+          ./check_helm_chart "$HELM_CHART"
+
+  update-helm:
     runs-on: ubuntu-latest
     needs: check-helm
     steps:
@@ -72,20 +76,19 @@ jobs:
           : "${HELM_REPO_PASSWORD:?must be set}"
 
       - name: Run Helm Lint
-        run: helm lint $HELM_CHART
+        run: helm lint "$HELM_CHART"
 
       - name: Run Check Helm Script and Upload
         run: |
           chmod +x ./check_helm_chart
-          ./check_helm_chart $HELM_CHART --upload
+          ./check_helm_chart "$HELM_CHART" --upload
 
-          
   kaniko-build:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         build_type: [tag, stable]
-   
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -93,50 +96,55 @@ jobs:
           submodules: true
           fetch-depth: 0
 
-      - name: Set Docker Config
-        if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master'
-        run: |
-          echo "{\"auths\":{
-            \"$CI_REGISTRY\": {
-              \"username\":\"$CI_REGISTRY_USER\", 
-              \"password\":\"$CI_REGISTRY_PASSWORD\"
-            },
-            \"eccr.ecmwf.int/harbor\": {
-              \"username\":\"$ECCR_USER\", 
-              \"password\":\"$ECCR_PASSWORD\"
-            }
-          }}" > docker-config.json
+      - name: Login to GHCR
+        if: (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || (matrix.build_type == 'stable' && github.ref_name == 'master')
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Login to ECCR Harbor
+        if: (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || (matrix.build_type == 'stable' && github.ref_name == 'master')
+        uses: docker/login-action@v3
+        with:
+          registry: eccr.ecmwf.int/harbor
+          username: ${{ env.ECCR_USER }}
+          password: ${{ env.ECCR_PASSWORD }}
 
       - name: Set Kaniko Build Variables
-        if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master'
+        if: (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || (matrix.build_type == 'stable' && github.ref_name == 'master')
         run: |
-          SHORT_SHA=${GITHUB_SHA::7}
+          KANIKO_ARGS=""
           if [[ "${{ matrix.build_type }}" == "tag" ]]; then
-            echo "KANIKO_ARGS=--destination eccr.ecmwf.int/geoglows_api/geoglows_api:${{ github.ref_name }} --destination eccr.ecmwf.int/geoglows_api/geoglows_api:latest" >> $GITHUB_ENV
+            KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:${{ github.ref_name }}"
+            KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:latest"
+            KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:${{ github.ref_name }}"
+            KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:latest"
           elif [[ "${{ matrix.build_type }}" == "stable" && "${{ github.ref_name }}" == "master" ]]; then
-            echo "KANIKO_ARGS=--destination eccr.ecmwf.int/geoglows_api/geoglows_api:stable" >> $GITHUB_ENV
+            KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:stable"
+            # Uncomment to also push stable to ECCR:
+            # KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:stable"
           else
             echo "No valid build type" >&2
             exit 1
           fi
+          echo "KANIKO_ARGS=${KANIKO_ARGS}" >> "$GITHUB_ENV"
 
       - name: Run Kaniko Build & Push
-        if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master'
+        if: (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || (matrix.build_type == 'stable' && github.ref_name == 'master')
         run: |
           [[ -z "${KANIKO_DOCKERFILE}" ]] && echo "KANIKO_DOCKERFILE must be set" && exit 1
           [[ -z "${KANIKO_CONTEXT}" ]] && echo "KANIKO_CONTEXT must be set" && exit 1
           [[ -z "${KANIKO_ARGS}" ]] && echo "KANIKO_ARGS must be set" && exit 1
 
-          # Combine final args
-          KANIKO_ARGS="--context ${KANIKO_CONTEXT} --dockerfile ${KANIKO_DOCKERFILE} ${KANIKO_ARGS} --cache=true --cache-repo ${CI_REGISTRY_IMAGE}/cache --force"
+          FINAL_ARGS="--context ${KANIKO_CONTEXT} --dockerfile ${KANIKO_DOCKERFILE} ${KANIKO_ARGS} --cache=true --cache-repo ${CI_REGISTRY_IMAGE}/cache --force"
 
           echo "Running Kaniko with:"
-          echo "$KANIKO_ARGS"
+          echo "${FINAL_ARGS}"
 
           docker run --rm \
             -v "${{ github.workspace }}:/workspace" \
-            -v "${{ github.workspace }}/docker-config.json:/kaniko/.docker/config.json" \
+            -v "$HOME/.docker:/kaniko/.docker:ro" \
             ${{ env.KANIKO_IMAGE }} \
-            $KANIKO_ARGS
-
-      
\ No newline at end of file
+            ${FINAL_ARGS}
diff --git a/.github/workflows/deploy_to_production.yml b/.github/workflows/deploy_to_production.yml
index 511a230..9ccefa1 100644
--- a/.github/workflows/deploy_to_production.yml
+++ b/.github/workflows/deploy_to_production.yml
@@ -4,6 +4,10 @@ name: Deploy to Production
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: read  
+
 env:
   ECCR_GEOGLOWS_TOKEN: ${{ secrets.ECCR_GEOGLOWS_TOKEN }}
 
@@ -11,8 +15,6 @@ jobs:
   deploy:
     name: Deploy to Production
     runs-on: ubuntu-latest
-    container: 
-      image: docker.aquaveo.com/tethys/kubernetes/helm-docker:2.0.0-rc1
     
     steps:
       - name: Deploy to Production
diff --git a/.github/workflows/deploy_to_staging.yml b/.github/workflows/deploy_to_staging.yml
index 657fabf..06735c1 100644
--- a/.github/workflows/deploy_to_staging.yml
+++ b/.github/workflows/deploy_to_staging.yml
@@ -4,6 +4,10 @@ name: Deploy to Staging
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: read
+
 env:
   ECCR_GEOGLOWS_TOKEN: ${{ secrets.ECCR_GEOGLOWS_TOKEN }}
 
@@ -11,8 +15,6 @@ jobs:
   deploy:
     name: Deploy to Staging
     runs-on: ubuntu-latest
-    container: 
-      image: docker.aquaveo.com/tethys/kubernetes/helm-docker:2.0.0-rc1
     
     steps:
       - name: Deploy to Staging