diff --git a/tests/stability/cassandra_stress.sh b/tests/stability/cassandra_stress.sh
index 7048a2b5f9..938188af88 100755
--- a/tests/stability/cassandra_stress.sh
+++ b/tests/stability/cassandra_stress.sh
@@ -11,9 +11,14 @@ SCRIPT_PATH=$(dirname "$(readlink -f "$0")")
 # shellcheck source=/dev/null
 source "${SCRIPT_PATH}/common_stability.bash"
 
-IMAGE="docker.io/library/cassandra:latest"
+# Pull from the kata-containers ghcr.io mirror by default instead of Docker
+# Hub. Override REGISTRY to use a different source.
+REGISTRY="${REGISTRY:-ghcr.io/kata-containers}"
+IMAGE="${REGISTRY}/cassandra:latest"
 CONTAINER_NAME="${CONTAINER_NAME:-cassandra_test}"
-DOCKER_IMAGE="cassandra:latest"
+DOCKER_IMAGE="${IMAGE}"
+# Local archive name; must be slash-free as it is used as a filename.
+IMAGE_TAR="cassandra.tar"
 PAYLOAD_ARGS="${PAYLOAD_ARGS:-tail -f /dev/null}"
 CMD="cassandra -R"
 
@@ -25,9 +30,9 @@ function main() {
 	# DOCKER_EXE, CTR_EXE, and CTR_RUNTIME are set by common.bash's init_env
 	# shellcheck disable=SC2154
 	sudo -E "${DOCKER_EXE}" pull "${DOCKER_IMAGE}"
-	sudo -E "${DOCKER_EXE}" save -o "${DOCKER_IMAGE}.tar" "${DOCKER_IMAGE}"
+	sudo -E "${DOCKER_EXE}" save -o "${IMAGE_TAR}" "${DOCKER_IMAGE}"
 	# shellcheck disable=SC2154
-	sudo -E "${CTR_EXE}" i import "${DOCKER_IMAGE}.tar"
+	sudo -E "${CTR_EXE}" i import "${IMAGE_TAR}"
 
 	# shellcheck disable=SC2154
 	sudo -E "${CTR_EXE}" run -d --runtime "${CTR_RUNTIME}" "${IMAGE}" "${CONTAINER_NAME}" sh -c "${PAYLOAD_ARGS}"
diff --git a/tests/stability/common_stability.bash b/tests/stability/common_stability.bash
index ada959ae95..6b3cebdd42 100644
--- a/tests/stability/common_stability.bash
+++ b/tests/stability/common_stability.bash
@@ -19,9 +19,12 @@ KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
 http_proxy="${http_proxy:-}"
 https_proxy="${https_proxy:-}"
 
+# Prefer the kata-containers ghcr.io mirror over Docker Hub; the remaining
+# entries are kept as fallbacks. Override REGISTRY to change the primary source.
 declare -A registries
 registries[ubuntu]=\
-"docker.io/library
+"${REGISTRY:-ghcr.io/kata-containers}
+docker.io/library
 public.ecr.aws/lts
 mirror.gcr.io/library
 quay.io/libpod"
diff --git a/tests/stability/stressng_dockerfile/.gitignore b/tests/stability/stressng_dockerfile/.gitignore
new file mode 100644
index 0000000000..666158c736
--- /dev/null
+++ b/tests/stability/stressng_dockerfile/.gitignore
@@ -0,0 +1,3 @@
+# Generated at test time from Dockerfile.in by common_stability.bash
+# (@UBUNTU_REGISTRY@ is substituted with the first working registry).
+/Dockerfile
diff --git a/tests/stability/stressng_dockerfile/Dockerfile b/tests/stability/stressng_dockerfile/Dockerfile.in
similarity index 91%
rename from tests/stability/stressng_dockerfile/Dockerfile
rename to tests/stability/stressng_dockerfile/Dockerfile.in
index b17002c1e4..588524af29 100644
--- a/tests/stability/stressng_dockerfile/Dockerfile
+++ b/tests/stability/stressng_dockerfile/Dockerfile.in
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM ubuntu:20.04
+FROM @UBUNTU_REGISTRY@/ubuntu:20.04
 
 # Version of the Dockerfile
 LABEL DOCKERFILE_VERSION="1.0"