diff --git a/apps/base/logging/clickhouseinstallation.yaml b/apps/base/logging/clickhouseinstallation.yaml
index 72641a4..886bbcf 100644
--- a/apps/base/logging/clickhouseinstallation.yaml
+++ b/apps/base/logging/clickhouseinstallation.yaml
@@ -87,7 +87,7 @@ spec:
             runAsGroup: 101
           containers:
             - name: clickhouse
-              image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
+              image: docker.io/clickhouse/clickhouse-server:24.8
               resources:
                 requests:
                   cpu: 500m
diff --git a/apps/base/logging/job_clickhouse-schema.yaml b/apps/base/logging/job_clickhouse-schema.yaml
index 2df42b8..ecc3143 100644
--- a/apps/base/logging/job_clickhouse-schema.yaml
+++ b/apps/base/logging/job_clickhouse-schema.yaml
@@ -32,7 +32,7 @@ spec:
         runAsGroup: 101
       containers:
         - name: clickhouse-schema
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
+          image: docker.io/clickhouse/clickhouse-server:24.8
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
diff --git a/apps/base/logging/logviewer/oauth2-proxy-deployment.yaml b/apps/base/logging/logviewer/oauth2-proxy-deployment.yaml
index adfc739..57b5e9a 100644
--- a/apps/base/logging/logviewer/oauth2-proxy-deployment.yaml
+++ b/apps/base/logging/logviewer/oauth2-proxy-deployment.yaml
@@ -34,7 +34,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh
diff --git a/apps/base/logging/nats-bootstrap-job.yaml b/apps/base/logging/nats-bootstrap-job.yaml
index dd27630..296b1a8 100644
--- a/apps/base/logging/nats-bootstrap-job.yaml
+++ b/apps/base/logging/nats-bootstrap-job.yaml
@@ -58,7 +58,7 @@ spec:
         runAsGroup: 1000
       containers:
         - name: nats-bootstrap
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-box:0.18.0
+          image: docker.io/natsio/nats-box:0.18.0
           # nats CLI stats the working directory when loading its response
           # schemas; under readOnlyRootFilesystem + runAsUser 1000 the image's
           # default WORKDIR is not accessible ("stat .: permission denied"), so
diff --git a/apps/overlays/au-syd1/logging/values-nats.yaml b/apps/overlays/au-syd1/logging/values-nats.yaml
index f482dff..6c0d582 100644
--- a/apps/overlays/au-syd1/logging/values-nats.yaml
+++ b/apps/overlays/au-syd1/logging/values-nats.yaml
@@ -57,10 +57,9 @@ config:
                 - "_INBOX.>"
 
 container:
-  # Pulled through the artifactapi dockerhub remote (upstream official nats;
-  # no DHI variant available for nats).
+  # Upstream official nats; no DHI variant available.
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/nats
+    repository: docker.io/library/nats
     tag: 2.14.2-alpine
   env:
     NATS_ADMIN_PASSWORD:
@@ -94,10 +93,10 @@ podTemplate:
       annotations:
         configmap.reloader.stakater.com/auto: "true"
 
-# Config-reloader sidecar image, also through artifactapi.
+# Config-reloader sidecar image.
 reloader:
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-server-config-reloader
+    repository: docker.io/natsio/nats-server-config-reloader
     tag: "0.23.0"
 
 natsBox:
diff --git a/apps/overlays/au-syd1/logging/values-vector-agent.yaml b/apps/overlays/au-syd1/logging/values-vector-agent.yaml
index d20092a..a05a805 100644
--- a/apps/overlays/au-syd1/logging/values-vector-agent.yaml
+++ b/apps/overlays/au-syd1/logging/values-vector-agent.yaml
@@ -5,10 +5,10 @@
 role: Agent
 fullnameOverride: vector-agent
 
-# Pulled through the artifactapi dockerhub remote; distroless-libc (no DHI —
-# subscription-gated/private-namespace, not reachable via the anon proxy).
+# distroless-libc (no DHI — subscription-gated/private-namespace, not reachable
+# via the anon proxy).
 image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
+  repository: docker.io/timberio/vector
   tag: 0.57.0-distroless-libc
 
 rbac:
diff --git a/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml b/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml
index f6226b4..549c19e 100644
--- a/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml
+++ b/apps/overlays/au-syd1/logging/values-vector-aggregator.yaml
@@ -15,7 +15,7 @@ role: Stateless-Aggregator
 fullnameOverride: vector-aggregator
 
 image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
+  repository: docker.io/timberio/vector
   tag: 0.57.0-distroless-libc
 
 # Horizontal autoscaling on CPU — safe with N replicas on one durable consumer.
diff --git a/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml b/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml
index c915c7a..9e66a91 100644
--- a/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml
+++ b/apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml
@@ -6,7 +6,7 @@ fullnameOverride: vector-vm-ingest
 replicas: 2
 
 image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
+  repository: docker.io/timberio/vector
   tag: 0.57.0-distroless-libc
 
 workloadResourceAnnotations: