diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8ba24c2..919c277 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -9,8 +9,10 @@ variables:
   DOCKER_BUILDKIT: "1"
   # apt mirror used inside both images (override per pipeline if needed)
   APT_MIRROR: "http://mirrors.tuna.tsinghua.edu.cn/ubuntu"
-  # Images are shared through Docker Hub (never as artifacts).
-  IMAGE: "docker.io/$DOCKERHUB_USERNAME/$CI_PROJECT_NAME"
+  # Images are shared through Harbor (plain HTTP), never as artifacts.
+  HARBOR_HOST: "192.168.1.11:9090"
+  HARBOR_PROJECT: "openra3"
+  IMAGE: "$HARBOR_HOST/$HARBOR_PROJECT/$CI_PROJECT_NAME"
 
 # dind pulls docker.io images through the intranet Harbor pull-through cache.
 # NOTE: anchor only the *array* so `services: *dind` stays an array.
@@ -20,7 +22,7 @@ variables:
       - --registry-mirror=http://192.168.1.11:9090/dockerhub
       - --insecure-registry=192.168.1.11:9090
 
-# --- build the two isolated toolchain images and push them --------------------
+# --- build the two isolated toolchain images and push them to Harbor ----------
 linux_image:
   stage: image
   image: docker:latest
@@ -28,7 +30,7 @@ linux_image:
   tags:
     - docker
   script:
-    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+    - echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin
     # Registry cache export needs the docker-container driver, not the default
     # docker driver ("Cache export is not supported for the docker driver").
     - docker buildx create --use --name ci-builder --driver docker-container
@@ -48,7 +50,7 @@ windows_image:
   tags:
     - docker
   script:
-    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+    - echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin
     - docker buildx create --use --name ci-builder --driver docker-container
     - |
       docker buildx build \
@@ -69,7 +71,7 @@ build_linux:
   needs:
     - linux_image
   script:
-    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+    - echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin
     - docker pull $IMAGE:$CI_COMMIT_SHORT_SHA-linux
     - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux cmake -S . -B build/linux -G Ninja -DCMAKE_BUILD_TYPE=Release
     - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux cmake --build build/linux -j
@@ -90,7 +92,7 @@ build_windows:
   needs:
     - windows_image
   script:
-    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+    - echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin
     - docker pull $IMAGE:$CI_COMMIT_SHORT_SHA-windows
     - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows
         cmake -S . -B build/windows -G Ninja