diff --git a/.ko.yaml b/.ko.yaml
index 32bcf9ba813..e11a59d5794 100644
--- a/.ko.yaml
+++ b/.ko.yaml
@@ -1,4 +1,4 @@
-defaultBaseImage: gcr.io/distroless/static:nonroot
+defaultBaseImage: ghcr.io/distroless/static
 baseImageOverrides:
   # git-init uses a base image that includes Git, and supports running either
   # as root or as user nonroot with UID 65532.
diff --git a/tekton/publish.yaml b/tekton/publish.yaml
index cc15aef76b4..5201987b155 100644
--- a/tekton/publish.yaml
+++ b/tekton/publish.yaml
@@ -95,13 +95,13 @@ spec:
 
       # Combine Distroless with a Windows base image, used for the entrypoint image.
       COMBINED_BASE_IMAGE=$(go run ./vendor/github.com/tektoncd/plumbing/cmd/combine/main.go \
-        gcr.io/distroless/static:nonroot \
-        mcr.microsoft.com/windows/nanoserver:1809 \
+        ghcr.io/distroless/static \
+        mcr.microsoft.com/windows/nanoserver:ltsc2022 \
         ${CONTAINER_REGISTRY}/$(params.package)/combined-base-image:latest)
 
       cat <<EOF > ${PROJECT_ROOT}/.ko.yaml
       # This matches the value configured in .ko.yaml
-      defaultBaseImage: gcr.io/distroless/static:nonroot
+      defaultBaseImage: ghcr.io/distroless/static
       baseImageOverrides:
         # Use the combined base image for images that should include Windows support.
         $(params.package)/cmd/entrypoint: ${COMBINED_BASE_IMAGE}