diff --git a/tests/functional/vfio-ap/run.sh b/tests/functional/vfio-ap/run.sh
index dd8c1adf3c..cd9790d18e 100755
--- a/tests/functional/vfio-ap/run.sh
+++ b/tests/functional/vfio-ap/run.sh
@@ -30,7 +30,9 @@ trap cleanup EXIT
 
 # Prevent the program from exiting on error
 trap - ERR
-registry_image="registry:2.8.3"
+# Pull from the kata-containers ghcr.io mirror by default instead of Docker Hub.
+REGISTRY="${REGISTRY:-ghcr.io/kata-containers}"
+registry_image="${REGISTRY}/registry:2.8.3"
 
 setup_config_file() {
     local target_item=$1
diff --git a/tests/integration/cri-containerd/integration-tests.sh b/tests/integration/cri-containerd/integration-tests.sh
index 8a680a54c8..fd40cece19 100755
--- a/tests/integration/cri-containerd/integration-tests.sh
+++ b/tests/integration/cri-containerd/integration-tests.sh
@@ -32,6 +32,11 @@ FACTORY_TEST=${FACTORY_TEST:-""}
 ARCH=$(uname -m)
 SANDBOXER=${SANDBOXER:-"podsandbox"}
 
+# Pull test images from the kata-containers ghcr.io mirror by default instead
+# of Docker Hub. Override REGISTRY/BUSYBOX_IMAGE to use a different source.
+REGISTRY="${REGISTRY:-ghcr.io/kata-containers}"
+BUSYBOX_IMAGE="${BUSYBOX_IMAGE:-${REGISTRY}/busybox:1.37.0}"
+
 containerd_runtime_type="io.containerd.kata-${KATA_HYPERVISOR}.v2"
 
 containerd_shim_path="$(command -v containerd-shim || true)"
@@ -307,7 +312,7 @@ function testContainerStart() {
 
 	local pod_yaml=${REPORT_DIR}/pod.yaml
 	local container_yaml=${REPORT_DIR}/container.yaml
-	local image="busybox:latest"
+	local image="${BUSYBOX_IMAGE}"
 
 	cat << EOF > "${pod_yaml}"
 metadata:
@@ -470,7 +475,7 @@ function TestContainerSwap() {
 	fi
 
 	local container_yaml=${REPORT_DIR}/container.yaml
-	local image="busybox:latest"
+	local image="${BUSYBOX_IMAGE}"
 
 	info "Test container with guest swap"
 
@@ -622,7 +627,7 @@ function startDeviceCgroupContainers() {
 	local pod_yaml=${REPORT_DIR}/device-cgroup-pod.yaml
 	local container1_yaml=${REPORT_DIR}/device-cgroup-container1.yaml
 	local container2_yaml=${REPORT_DIR}/device-cgroup-container2.yaml
-	local image="busybox:latest"
+	local image="${BUSYBOX_IMAGE}"
 
     cat > "${pod_yaml}" <<EOF
 metadata:
diff --git a/tests/integration/docker/gha-run.sh b/tests/integration/docker/gha-run.sh
index bdb01f55d7..10e434ed84 100755
--- a/tests/integration/docker/gha-run.sh
+++ b/tests/integration/docker/gha-run.sh
@@ -14,7 +14,9 @@ kata_tarball_dir="${2:-kata-artifacts}"
 docker_dir="$(dirname "$(readlink -f "$0")")"
 # shellcheck source=/dev/null
 source "${docker_dir}/../../common.bash"
-image="${image:-instrumentisto/nmap:latest}"
+# Pull from the kata-containers ghcr.io mirror by default instead of Docker Hub.
+REGISTRY="${REGISTRY:-ghcr.io/kata-containers}"
+image="${image:-${REGISTRY}/nmap:latest}"
 
 function install_dependencies() {
 	info "Installing the dependencies needed for running the docker smoke test"
diff --git a/tests/integration/nerdctl/gha-run.sh b/tests/integration/nerdctl/gha-run.sh
index 5790cae3de..95117408cd 100755
--- a/tests/integration/nerdctl/gha-run.sh
+++ b/tests/integration/nerdctl/gha-run.sh
@@ -15,6 +15,12 @@ nerdctl_dir="$(dirname "$(readlink -f "$0")")"
 # shellcheck source=/dev/null
 source "${nerdctl_dir}/../../common.bash"
 
+# Pull test images from the kata-containers ghcr.io mirror by default instead
+# of Docker Hub. Override REGISTRY/NMAP_IMAGE/ALPINE_IMAGE to use another source.
+REGISTRY="${REGISTRY:-ghcr.io/kata-containers}"
+NMAP_IMAGE="${NMAP_IMAGE:-${REGISTRY}/nmap:latest}"
+ALPINE_IMAGE="${ALPINE_IMAGE:-${REGISTRY}/alpine:3.22}"
+
 function install_dependencies() {
 	info "Installing the dependencies for running the nerdctl tests"
 
@@ -80,7 +86,7 @@ function run() {
 	info "Running nerdctl smoke test tests using RunC"
 
 	info "Running nerdctl with runc"
-	sudo nerdctl run --rm --entrypoint nping instrumentisto/nmap --tcp-connect -c 2 -p 80 www.github.com
+	sudo nerdctl run --rm --entrypoint nping "${NMAP_IMAGE}" --tcp-connect -c 2 -p 80 www.github.com
 
 	local parent_interface="eth0"
 	# The following creates an ipvlan network with eth0 on host as parent. The test assumes
@@ -111,16 +117,16 @@ function run() {
 	info "Running nerdctl smoke test tests using ${KATA_HYPERVISOR} hypervisor"
 
 	info "Running nerdctl with Kata Containers (${KATA_HYPERVISOR})"
-	sudo nerdctl run --rm --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" --entrypoint nping instrumentisto/nmap --tcp-connect -c 2 -p 80 www.github.com
+	sudo nerdctl run --rm --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" --entrypoint nping "${NMAP_IMAGE}" --tcp-connect -c 2 -p 80 www.github.com
 
 	info "Running nerdctl with Kata Containers (${KATA_HYPERVISOR}) and multiple bridge nwtorks"
-	sudo nerdctl run --rm --net "${net1}" --net "${net2}" --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" alpine ip a
+	sudo nerdctl run --rm --net "${net1}" --net "${net2}" --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" "${ALPINE_IMAGE}" ip a
 
 	info "Running nerdctl with Kata Containers (${KATA_HYPERVISOR}) and ipvlan network"
-	sudo nerdctl run  --rm --net "${ipvlan_net_name}"  --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" alpine ip a | grep "eth0"
+	sudo nerdctl run  --rm --net "${ipvlan_net_name}"  --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" "${ALPINE_IMAGE}" ip a | grep "eth0"
 
 	info "Running nerdctl with Kata Containers (${KATA_HYPERVISOR}) and macvlan network"
-	sudo nerdctl run  --rm --net "${macvlan_net_name}"  --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" alpine ip a | grep "eth0"
+	sudo nerdctl run  --rm --net "${macvlan_net_name}"  --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" "${ALPINE_IMAGE}" ip a | grep "eth0"
 
 	info "Removing networks"
 	sudo nerdctl network rm "${macvlan_net_name}" "${ipvlan_net_name}"