diff --git a/.github/workflows/sync-registry.yaml b/.github/workflows/sync-registry.yaml
index 503ac07a5..34257be27 100644
--- a/.github/workflows/sync-registry.yaml
+++ b/.github/workflows/sync-registry.yaml
@@ -5,6 +5,13 @@ jobs:
   publish:
     runs-on: ubuntu-22.04
     steps:
+      - name: Login to target registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: test
+
       - name: Checkout repository
         uses: actions/checkout@v4
 
@@ -13,11 +20,9 @@ jobs:
         with:
           go-version: '>=1.22'
 
-      - run: go install github.com/regclient/regclient/cmd/regsync@latest
-
       - name: Sync registry.k8s.io to ghcr.io/canonical
-        env:
-          USERNAME: ${{ github.actor }}
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          regsync once --config ${GITHUB_WORKSPACE}/build-scripts/hack/sync-registry.yaml
+          curl -L https://github.com/regclient/regclient/releases/download/v0.6.1/regsync-linux-amd64 -o regsync
+          chmod +x regsync
+          ./regsync version
+          ./regsync once -c build-scripts/hack/regsync.yaml
diff --git a/build-scripts/hack/sync-registry.yaml b/build-scripts/hack/regsync.yaml
similarity index 52%
rename from build-scripts/hack/sync-registry.yaml
rename to build-scripts/hack/regsync.yaml
index 8b04c88f3..9d953d99b 100644
--- a/build-scripts/hack/sync-registry.yaml
+++ b/build-scripts/hack/regsync.yaml
@@ -1,9 +1,8 @@
 version: 1
-creds:
-  - registry: ghcr.io/canonical
-    user: "{{env \"USERNAME\"}}"
-    pass: "{{env \"TOKEN\"}}"
 sync:
   - source: registry.k8s.io/pause:3.7
     target: ghcr.io/canonical/pause:3.7
     type: image
+    tags:
+      allow:
+        - "*"
diff --git a/build-scripts/hack/sync-registry.sh b/build-scripts/hack/sync-registry.sh
new file mode 100755
index 000000000..152ad5f1f
--- /dev/null
+++ b/build-scripts/hack/sync-registry.sh
@@ -0,0 +1 @@
+regsync once ./sync-registry.yaml