diff --git a/.github/actions/docker-hub-mirror/action.yml b/.github/actions/docker-hub-mirror/action.yml
new file mode 100644
index 00000000..e11a02b9
--- /dev/null
+++ b/.github/actions/docker-hub-mirror/action.yml
@@ -0,0 +1,29 @@
+name: Docker Hub mirror
+description: Pulls Docker Hub images through mirror.gcr.io, so CI does not hit Docker Hub's anonymous pull limit.
+runs:
+  using: composite
+  steps:
+    - name: Configure Docker Hub mirror
+      shell: bash
+      run: |
+        set -euo pipefail
+        conf=/etc/docker/daemon.json
+        tmp=$(mktemp)
+        merged=$(mktemp)
+        # Keep any settings the runner image already has.
+        if sudo test -s "${conf}"; then
+          sudo cat "${conf}" >"${tmp}"
+        else
+          echo '{}' >"${tmp}"
+        fi
+        jq '(."registry-mirrors" // []) as $m | ."registry-mirrors" = $m + (["https://mirror.gcr.io"] - $m)' "${tmp}" >"${merged}"
+        sudo install -D -m 644 "${merged}" "${conf}"
+        rm -f "${tmp}" "${merged}"
+        sudo systemctl restart docker
+        # The daemon pulls from the mirror first and falls back to Docker Hub
+        # when the mirror misses or is down. Fail here, not on a later 429, if
+        # the setting did not take.
+        docker info | grep -A2 'Registry Mirrors' || true
+        mirrors=$(docker info --format '{{range .RegistryConfig.Mirrors}}{{println .}}{{end}}')
+        grep -q 'mirror.gcr.io' <<<"${mirrors}" \
+          || { echo "::error::mirror.gcr.io is not in the Docker daemon config"; exit 1; }
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f3fc04e5..0820919b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -173,6 +173,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: ./.github/actions/docker-hub-mirror
       - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
         with:
           just-version: 1.58.0
@@ -349,6 +350,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: ./.github/actions/docker-hub-mirror
       - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
         with:
           just-version: 1.58.0
@@ -432,6 +434,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: ./.github/actions/docker-hub-mirror
       - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
         with:
           just-version: 1.58.0
@@ -562,6 +565,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: ./.github/actions/docker-hub-mirror
       # release's static musl binaries, as dist/linux/<arch>/nisshi.
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -580,6 +584,10 @@ jobs:
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           buildkitd-flags: --debug
+          # BuildKit pulls base images itself, so it ignores the daemon's mirror.
+          buildkitd-config-inline: |
+            [registry."docker.io"]
+              mirrors = ["mirror.gcr.io"]
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{env.REGISTRY}}
@@ -640,6 +648,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: ./.github/actions/docker-hub-mirror
       - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
         with:
           just-version: 1.58.0
@@ -737,6 +746,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: ./.github/actions/docker-hub-mirror
       - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
         with:
           just-version: 1.58.0
diff --git a/.github/workflows/tier-c.yml b/.github/workflows/tier-c.yml
index 075c17fb..16f36c57 100644
--- a/.github/workflows/tier-c.yml
+++ b/.github/workflows/tier-c.yml
@@ -80,6 +80,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: ./.github/actions/docker-hub-mirror
       - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
         with:
           just-version: 1.58.0
@@ -133,6 +134,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: ./.github/actions/docker-hub-mirror
       - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
         with:
           just-version: 1.58.0
@@ -202,6 +204,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: ./.github/actions/docker-hub-mirror
       - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
         with:
           just-version: 1.58.0