diff --git a/.github/actions/build-container/action.yml b/.github/actions/build-container/action.yml
index 1eac2f9516d..bfecc52d5e5 100644
--- a/.github/actions/build-container/action.yml
+++ b/.github/actions/build-container/action.yml
@@ -12,11 +12,15 @@ inputs:
     required: false
     default: ""
   ghcr_username:
-    description: "Username for GHCR login"
+    description: "Username for GHCR login (github.actor when using the job's GITHUB_TOKEN)"
     required: true
   ghcr_password:
-    description: "Password for GHCR login"
+    description: "Password for GHCR login: the job's GITHUB_TOKEN with packages: write; the package must grant this repository Actions write access"
     required: true
+  image_source:
+    description: "Repository URL for the org.opencontainers.image.source label, which links the package to that repository (defaults to the building repository). Builds of a private mirror pass the public repository so shared packages stay linked to it."
+    required: false
+    default: ""
   git_sha:
     description: "Git SHA to use for image tagging (defaults to github.sha)"
     required: false
@@ -35,6 +39,9 @@ outputs:
   artifact_name:
     description: "The name of the uploaded artifact"
     value: ${{ inputs.image_name }}:${{ env.GIT_SHA_SHORT }}
+  image_digest:
+    description: "The registry manifest digest of the pushed image (sha256:...); deploy by this, not by tag"
+    value: ${{ env.IMAGE_DIGEST }}
 
 runs:
   using: "composite"
@@ -68,13 +75,19 @@ runs:
         [[ -n "$line" ]] && BUILD_ARGS_ARRAY+=("--build-arg" "$line")
       done <<< "${{ inputs.build_args }}"
 
+      # The source label links the package to this repository on first push, so GHCR access follows the
+      # repository and nobody has to link packages by hand.
       docker build \
         "${BUILD_ARGS_ARRAY[@]}" \
+        --label "org.opencontainers.image.source=${{ inputs.image_source || format('{0}/{1}', github.server_url, github.repository) }}" \
+        --label "org.opencontainers.image.revision=${{ inputs.git_sha || github.sha }}" \
         -f "$DOCKERFILE_PATH" \
         -t ${{ inputs.image_name }}:${{ env.GIT_SHA_SHORT }} \
         -t ${{ inputs.image_name }}:latest .
       docker push ${{ inputs.image_name }}:${{ env.GIT_SHA_SHORT }}
       docker push ${{ inputs.image_name }}:latest
+      IMAGE_DIGEST=$(docker inspect --format '{{index .RepoDigests 0}}' ${{ inputs.image_name }}:${{ env.GIT_SHA_SHORT }} | cut -d@ -f2)
+      echo "IMAGE_DIGEST=$IMAGE_DIGEST" >> $GITHUB_ENV
     shell: bash
 
   - name: Output image information
@@ -93,5 +106,6 @@ runs:
       echo "- **Image:** \`${{ inputs.image_name }}:${{ env.GIT_SHA_SHORT }}\`" >> $GITHUB_STEP_SUMMARY
       echo "- **Tag:** \`${{ env.GIT_SHA_SHORT }}\`" >> $GITHUB_STEP_SUMMARY
       echo "- **Tag:** \`latest\`" >> $GITHUB_STEP_SUMMARY
+      echo "- **Digest:** \`${{ env.IMAGE_DIGEST }}\`" >> $GITHUB_STEP_SUMMARY
       echo "- **Registry:** \`${{ inputs.image_name }}\`" >> $GITHUB_STEP_SUMMARY
     shell: bash
diff --git a/.github/workflows/build-versions.yaml b/.github/workflows/build-versions.yaml
index 887a614d6e1..5036a42bb23 100644
--- a/.github/workflows/build-versions.yaml
+++ b/.github/workflows/build-versions.yaml
@@ -1,5 +1,5 @@
 name: "🔨 Build Version"
-run-name: "Building version for ${{ inputs.ref || github.ref_name }}"
+run-name: "Building version for ${{ inputs.ref || github.ref_name }}${{ inputs.request_id && format(' [{0}]', inputs.request_id) || '' }}"
 on:
   push:
   workflow_dispatch:
@@ -11,6 +11,10 @@ on:
       build_profile:
         description: "The cargo build profile to use."
         default: "release"
+      request_id:
+        description: "Service Manager request id; shown in the run name so the dispatch can be correlated (D37)."
+        required: false
+        default: ""
 
 jobs:
   setup:
@@ -142,8 +146,8 @@ jobs:
             GIT_TAG=${{ needs.setup.outputs.git_tag }}
             GIT_BRANCH=${{ needs.setup.outputs.git_branch }}
             BUILD_DATE=${{ needs.setup.outputs.build_date }}
-          ghcr_username: ${{ vars.INFRA_GH_USER }}
-          ghcr_password: ${{ secrets.INFRA_GH_PAT }}
+          ghcr_username: ${{ github.actor }}
+          ghcr_password: ${{ secrets.GITHUB_TOKEN }}
           git_sha: ${{ needs.setup.outputs.git_sha }}
 
   container-aptos-debugger:
@@ -180,8 +184,8 @@ jobs:
             GIT_TAG=${{ needs.setup.outputs.git_tag }}
             GIT_BRANCH=${{ needs.setup.outputs.git_branch }}
             BUILD_DATE=${{ needs.setup.outputs.build_date }}
-          ghcr_username: ${{ vars.INFRA_GH_USER }}
-          ghcr_password: ${{ secrets.INFRA_GH_PAT }}
+          ghcr_username: ${{ github.actor }}
+          ghcr_password: ${{ secrets.GITHUB_TOKEN }}
           git_sha: ${{ needs.setup.outputs.git_sha }}
 
   binaries-aptos-faucet-service:
@@ -242,8 +246,8 @@ jobs:
             GIT_TAG=${{ needs.setup.outputs.git_tag }}
             GIT_BRANCH=${{ needs.setup.outputs.git_branch }}
             BUILD_DATE=${{ needs.setup.outputs.build_date }}
-          ghcr_username: ${{ vars.INFRA_GH_USER }}
-          ghcr_password: ${{ secrets.INFRA_GH_PAT }}
+          ghcr_username: ${{ github.actor }}
+          ghcr_password: ${{ secrets.GITHUB_TOKEN }}
           git_sha: ${{ needs.setup.outputs.git_sha }}
 
   binaries-aptos-tools:
diff --git a/.github/workflows/publish-builder-images.yaml b/.github/workflows/publish-builder-images.yaml
index 5fc8a10339c..e3874359e36 100644
--- a/.github/workflows/publish-builder-images.yaml
+++ b/.github/workflows/publish-builder-images.yaml
@@ -80,8 +80,8 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ vars.INFRA_GH_USER || github.actor }}
-          password: ${{ secrets.INFRA_GH_PAT || secrets.GITHUB_TOKEN }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and publish images
         shell: bash