diff --git a/docs/usage/self-hosted-configuration.md b/docs/usage/self-hosted-configuration.md
index d133a5eb347b6cb7757ffcb462570a8fba5c1f9b..7a8f9913f0d43cb6915fa33353ca2e77d5f245b4 100644
--- a/docs/usage/self-hosted-configuration.md
+++ b/docs/usage/self-hosted-configuration.md
@@ -312,17 +312,17 @@ For example, `{"dockerCliOptions": "--memory=4g"}` will add a CLI flag to the `d
 
 Read the [Docker Docs, configure runtime resource contraints](https://docs.docker.com/config/containers/resource_constraints/) to learn more.
 
-## dockerImagePrefix
+## dockerSidecarImage
 
-By default Renovate pulls the sidecar Docker containers from `docker.io/containerbase`.
-You can use the `dockerImagePrefix` option to override this default.
+By default Renovate pulls the sidecar Docker containers from `ghcr.io/containerbase/sidecar`.
+You can use the `dockerSidecarImage` option to override this default.
 
-Say you want to pull your images from `ghcr.io/containerbase` to bypass Docker Hub limits.
+Say you want to pull a custom image from `ghcr.io/your_company/sidecar`.
 You would put this in your configuration file:
 
 ```json
 {
-  "dockerImagePrefix": "ghcr.io/containerbase"
+  "dockerSidecarImage": "ghcr.io/your_company/sidecar"
 }
 ```
 
diff --git a/lib/config/global.ts b/lib/config/global.ts
index fca000190956f2e7370472b5f37704d8e5be2974..7c6149d2a6e8a1b75f87b2b57b62b61c7ad97848 100644
--- a/lib/config/global.ts
+++ b/lib/config/global.ts
@@ -15,7 +15,7 @@ export class GlobalConfig {
     'customEnvVariables',
     'dockerChildPrefix',
     'dockerCliOptions',
-    'dockerImagePrefix',
+    'dockerSidecarImage',
     'dockerUser',
     'dryRun',
     'exposeAllEnv',
diff --git a/lib/config/options/index.ts b/lib/config/options/index.ts
index 532404cbbd82ceb5df7f493e0ee775c7434c6d68..f2a027fa18dcf17afca5f2728ff771b8af238290 100644
--- a/lib/config/options/index.ts
+++ b/lib/config/options/index.ts
@@ -351,11 +351,11 @@ const options: RenovateOptions[] = [
     globalOnly: true,
   },
   {
-    name: 'dockerImagePrefix',
+    name: 'dockerSidecarImage',
     description:
-      'Change this value to override the default Renovate Docker sidecar image name prefix.',
+      'Change this value to override the default Renovate sidecar image.',
     type: 'string',
-    default: 'docker.io/containerbase',
+    default: 'ghcr.io/containerbase/sidecar:8.0.2',
     globalOnly: true,
   },
   {
diff --git a/lib/config/types.ts b/lib/config/types.ts
index 9758ce5fe71c589642b4fd1207fc9262d22102bf..6136e576397228bded60c4d3ddf74b5897b748b9 100644
--- a/lib/config/types.ts
+++ b/lib/config/types.ts
@@ -128,7 +128,7 @@ export interface RepoGlobalConfig {
   customEnvVariables?: Record<string, string>;
   dockerChildPrefix?: string;
   dockerCliOptions?: string;
-  dockerImagePrefix?: string;
+  dockerSidecarImage?: string;
   dockerUser?: string;
   dryRun?: DryRunConfig;
   executionTimeout?: number;
diff --git a/lib/modules/manager/bundler/artifacts.spec.ts b/lib/modules/manager/bundler/artifacts.spec.ts
index 841f8ecc899d2dd50797d3a26445a29913855d02..d131b7d5d3ec82d18b2ef257298eaaf43ab45744 100644
--- a/lib/modules/manager/bundler/artifacts.spec.ts
+++ b/lib/modules/manager/bundler/artifacts.spec.ts
@@ -37,6 +37,7 @@ const adminConfig: RepoGlobalConfig = {
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/cache'),
   containerbaseDir: join('/tmp/cache/containerbase'),
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
 };
 
 const config: UpdateArtifactsConfig = {};
@@ -279,7 +280,7 @@ describe('modules/manager/bundler/artifacts', () => {
           })
         ).toEqual([updatedGemfileLock]);
         expect(execSnapshots).toMatchObject([
-          { cmd: 'docker pull containerbase/sidecar' },
+          { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
           { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
           {
             cmd:
@@ -290,7 +291,7 @@ describe('modules/manager/bundler/artifacts', () => {
               '-e BUILDPACK_CACHE_DIR ' +
               '-e CONTAINERBASE_CACHE_DIR ' +
               '-w "/tmp/github/some/repo" ' +
-              'containerbase/sidecar' +
+              'ghcr.io/containerbase/sidecar' +
               ' bash -l -c "' +
               'install-tool ruby 1.2.0' +
               ' && ' +
@@ -339,7 +340,7 @@ describe('modules/manager/bundler/artifacts', () => {
           })
         ).toEqual([updatedGemfileLock]);
         expect(execSnapshots).toMatchObject([
-          { cmd: 'docker pull containerbase/sidecar' },
+          { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
           { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
           {
             cmd:
@@ -350,7 +351,7 @@ describe('modules/manager/bundler/artifacts', () => {
               '-e BUILDPACK_CACHE_DIR ' +
               '-e CONTAINERBASE_CACHE_DIR ' +
               '-w "/tmp/github/some/repo" ' +
-              'containerbase/sidecar' +
+              'ghcr.io/containerbase/sidecar' +
               ' bash -l -c "' +
               'install-tool ruby 1.2.5' +
               ' && ' +
@@ -401,7 +402,7 @@ describe('modules/manager/bundler/artifacts', () => {
           })
         ).toEqual([updatedGemfileLock]);
         expect(execSnapshots).toMatchObject([
-          { cmd: 'docker pull containerbase/sidecar' },
+          { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
           { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
           {
             cmd:
@@ -412,7 +413,7 @@ describe('modules/manager/bundler/artifacts', () => {
               '-e BUILDPACK_CACHE_DIR ' +
               '-e CONTAINERBASE_CACHE_DIR ' +
               '-w "/tmp/github/some/repo" ' +
-              'containerbase/sidecar' +
+              'ghcr.io/containerbase/sidecar' +
               ' bash -l -c "' +
               'install-tool ruby 1.3.0' +
               ' && ' +
@@ -462,7 +463,7 @@ describe('modules/manager/bundler/artifacts', () => {
           })
         ).toEqual([updatedGemfileLock]);
         expect(execSnapshots).toMatchObject([
-          { cmd: 'docker pull containerbase/sidecar' },
+          { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
           { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
           {
             cmd:
@@ -474,7 +475,7 @@ describe('modules/manager/bundler/artifacts', () => {
               '-e BUILDPACK_CACHE_DIR ' +
               '-e CONTAINERBASE_CACHE_DIR ' +
               '-w "/tmp/github/some/repo" ' +
-              'containerbase/sidecar' +
+              'ghcr.io/containerbase/sidecar' +
               ' bash -l -c "' +
               'install-tool ruby 1.2.0' +
               ' && ' +
@@ -533,7 +534,7 @@ describe('modules/manager/bundler/artifacts', () => {
           })
         ).toEqual([updatedGemfileLock]);
         expect(execSnapshots).toMatchObject([
-          { cmd: 'docker pull containerbase/sidecar' },
+          { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
           { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
           {
             cmd:
@@ -544,7 +545,7 @@ describe('modules/manager/bundler/artifacts', () => {
               '-e BUILDPACK_CACHE_DIR ' +
               '-e CONTAINERBASE_CACHE_DIR ' +
               '-w "/tmp/github/some/repo" ' +
-              'containerbase/sidecar' +
+              'ghcr.io/containerbase/sidecar' +
               ' bash -l -c "' +
               'install-tool ruby 1.2.0' +
               ' && ' +
@@ -605,7 +606,7 @@ describe('modules/manager/bundler/artifacts', () => {
           })
         ).toEqual([updatedGemfileLock]);
         expect(execSnapshots).toMatchObject([
-          { cmd: 'docker pull containerbase/sidecar' },
+          { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
           { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
           {
             cmd:
@@ -616,7 +617,7 @@ describe('modules/manager/bundler/artifacts', () => {
               '-e BUILDPACK_CACHE_DIR ' +
               '-e CONTAINERBASE_CACHE_DIR ' +
               '-w "/tmp/github/some/repo" ' +
-              'containerbase/sidecar' +
+              'ghcr.io/containerbase/sidecar' +
               ' bash -l -c "' +
               'install-tool ruby 1.2.0' +
               ' && ' +
@@ -676,7 +677,7 @@ describe('modules/manager/bundler/artifacts', () => {
           })
         ).toEqual([updatedGemfileLock]);
         expect(execSnapshots).toMatchObject([
-          { cmd: 'docker pull containerbase/sidecar' },
+          { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
           { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
           {
             cmd:
@@ -687,7 +688,7 @@ describe('modules/manager/bundler/artifacts', () => {
               '-e BUILDPACK_CACHE_DIR ' +
               '-e CONTAINERBASE_CACHE_DIR ' +
               '-w "/tmp/github/some/repo" ' +
-              'containerbase/sidecar' +
+              'ghcr.io/containerbase/sidecar' +
               ' bash -l -c "' +
               'install-tool ruby 1.2.0' +
               ' && ' +
diff --git a/lib/modules/manager/cargo/artifacts.spec.ts b/lib/modules/manager/cargo/artifacts.spec.ts
index 1ad6453f3c633106327e04a5f6b07dbe52d2e78b..99b32f0f359135e3445ce98a314b2c35dcd2083d 100644
--- a/lib/modules/manager/cargo/artifacts.spec.ts
+++ b/lib/modules/manager/cargo/artifacts.spec.ts
@@ -21,6 +21,7 @@ const adminConfig: RepoGlobalConfig = {
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/cache'),
   containerbaseDir: join('/tmp/cache/containerbase'),
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
 };
 
 describe('modules/manager/cargo/artifacts', () => {
@@ -210,7 +211,7 @@ describe('modules/manager/cargo/artifacts', () => {
       },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       {},
       {
         cmd:
@@ -220,7 +221,7 @@ describe('modules/manager/cargo/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar ' +
+          'ghcr.io/containerbase/sidecar ' +
           'bash -l -c "' +
           'install-tool rust 1.65.0' +
           ' && ' +
diff --git a/lib/modules/manager/cocoapods/__snapshots__/artifacts.spec.ts.snap b/lib/modules/manager/cocoapods/__snapshots__/artifacts.spec.ts.snap
index 3dab15063ae67d7c7e52e670b4d446fda882e3ee..78c9fda40c6bca0df8c3c566e6c17c0ead0c23b4 100644
--- a/lib/modules/manager/cocoapods/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/modules/manager/cocoapods/__snapshots__/artifacts.spec.ts.snap
@@ -57,13 +57,13 @@ exports[`modules/manager/cocoapods/artifacts returns pod exec error 1`] = `
 exports[`modules/manager/cocoapods/artifacts returns updated Podfile 1`] = `
 [
   {
-    "cmd": "docker pull containerbase/sidecar",
+    "cmd": "docker pull ghcr.io/containerbase/sidecar",
     "options": {
       "encoding": "utf-8",
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/cache":"/tmp/cache" -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool ruby 3.1.0 && install-tool cocoapods 3.1.0 && gem install cocoapods-acknowledgements && pod install"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/cache":"/tmp/cache" -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool ruby 3.1.0 && install-tool cocoapods 3.1.0 && gem install cocoapods-acknowledgements && pod install"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -88,13 +88,13 @@ exports[`modules/manager/cocoapods/artifacts returns updated Podfile 1`] = `
 exports[`modules/manager/cocoapods/artifacts returns updated Podfile and Pods files 1`] = `
 [
   {
-    "cmd": "docker pull containerbase/sidecar",
+    "cmd": "docker pull ghcr.io/containerbase/sidecar",
     "options": {
       "encoding": "utf-8",
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/cache":"/tmp/cache" -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool ruby 3.1.0 && install-tool cocoapods 3.1.0 && pod install"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/cache":"/tmp/cache" -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool ruby 3.1.0 && install-tool cocoapods 3.1.0 && pod install"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/modules/manager/cocoapods/artifacts.spec.ts b/lib/modules/manager/cocoapods/artifacts.spec.ts
index a4caf0fe10d5b8dfebf2bf308352048f69426eef..6abfc45974d42e83583739fc1fc9ff970d60cd63 100644
--- a/lib/modules/manager/cocoapods/artifacts.spec.ts
+++ b/lib/modules/manager/cocoapods/artifacts.spec.ts
@@ -26,6 +26,7 @@ const adminConfig: RepoGlobalConfig = {
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/cache'),
   containerbaseDir: join('/tmp/cache/containerbase'),
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
 };
 
 describe('modules/manager/cocoapods/artifacts', () => {
@@ -252,7 +253,7 @@ describe('modules/manager/cocoapods/artifacts', () => {
       config,
     });
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       {
         cmd:
           'docker run --rm --name=renovate_sidecar --label=renovate_child ' +
@@ -261,7 +262,7 @@ describe('modules/manager/cocoapods/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool ruby 3.1.0' +
           ' && ' +
diff --git a/lib/modules/manager/composer/artifacts.spec.ts b/lib/modules/manager/composer/artifacts.spec.ts
index bd197b7233d21c7a1ec5f06209148ba14cd81473..089389a9b57e5437418e286ce24f26a69b360928 100644
--- a/lib/modules/manager/composer/artifacts.spec.ts
+++ b/lib/modules/manager/composer/artifacts.spec.ts
@@ -33,6 +33,7 @@ const adminConfig: RepoGlobalConfig = {
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/renovate/cache'),
   containerbaseDir: join('/tmp/renovate/cache/containerbase'),
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
 };
 
 const repoStatus = partial<StatusResult>({
@@ -784,7 +785,7 @@ describe('modules/manager/composer/artifacts', () => {
     ]);
     expect(execSnapshots).toMatchObject([
       {
-        cmd: 'docker pull containerbase/sidecar',
+        cmd: 'docker pull ghcr.io/containerbase/sidecar',
         options: {
           encoding: 'utf-8',
         },
@@ -804,7 +805,7 @@ describe('modules/manager/composer/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool php 7.3' +
           ' && ' +
diff --git a/lib/modules/manager/gomod/artifacts.spec.ts b/lib/modules/manager/gomod/artifacts.spec.ts
index aee0645b62011a349353051f2c3c0fe249bae323..434e850d1aa8b572a310d1bdcd03b66fcb23223b 100644
--- a/lib/modules/manager/gomod/artifacts.spec.ts
+++ b/lib/modules/manager/gomod/artifacts.spec.ts
@@ -59,6 +59,7 @@ const adminConfig: RepoGlobalConfig = {
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/renovate/cache'),
   containerbaseDir: join('/tmp/renovate/cache/containerbase'),
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
 };
 
 const config: UpdateArtifactsConfig = {
@@ -308,7 +309,7 @@ describe('modules/manager/gomod/artifacts', () => {
       },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -325,7 +326,7 @@ describe('modules/manager/gomod/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool golang 1.14.0' +
           ' && ' +
@@ -465,7 +466,7 @@ describe('modules/manager/gomod/artifacts', () => {
       },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -495,7 +496,7 @@ describe('modules/manager/gomod/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool golang 1.14.0' +
           ' && ' +
@@ -576,7 +577,7 @@ describe('modules/manager/gomod/artifacts', () => {
       },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       {},
       {
         options: {
@@ -990,7 +991,7 @@ describe('modules/manager/gomod/artifacts', () => {
       { file: { contents: 'New go.sum 2', path: 'go.mod', type: 'addition' } },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       {},
       {
         cmd:
@@ -1007,7 +1008,7 @@ describe('modules/manager/gomod/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool golang 1.14.0' +
           ' && ' +
@@ -1055,7 +1056,7 @@ describe('modules/manager/gomod/artifacts', () => {
       { file: { contents: 'New go.sum 2', path: 'go.mod', type: 'addition' } },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       {},
       {
         cmd:
@@ -1072,7 +1073,7 @@ describe('modules/manager/gomod/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool golang 1.14.0' +
           ' && ' +
@@ -1120,7 +1121,7 @@ describe('modules/manager/gomod/artifacts', () => {
       { file: { contents: 'New go.sum 2', path: 'go.mod', type: 'addition' } },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       {},
       {
         cmd:
@@ -1137,7 +1138,7 @@ describe('modules/manager/gomod/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool golang 1.14.0' +
           ' && ' +
@@ -1185,7 +1186,7 @@ describe('modules/manager/gomod/artifacts', () => {
       { file: { contents: 'New go.sum 2', path: 'go.mod', type: 'addition' } },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       {},
       {
         cmd:
@@ -1202,7 +1203,7 @@ describe('modules/manager/gomod/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool golang 1.14.0' +
           ' && ' +
@@ -1842,7 +1843,7 @@ describe('modules/manager/gomod/artifacts', () => {
     ]);
     const expectedResult = [
       {
-        cmd: 'docker pull containerbase/sidecar',
+        cmd: 'docker pull ghcr.io/containerbase/sidecar',
       },
       {},
       {
@@ -1860,7 +1861,7 @@ describe('modules/manager/gomod/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool golang 1.17.0' +
           ' && ' +
@@ -1917,7 +1918,7 @@ describe('modules/manager/gomod/artifacts', () => {
     ]);
     const expectedResult = [
       {
-        cmd: 'docker pull containerbase/sidecar',
+        cmd: 'docker pull ghcr.io/containerbase/sidecar',
       },
       {},
       {
@@ -1935,7 +1936,7 @@ describe('modules/manager/gomod/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool golang 1.14.0' +
           ' && ' +
diff --git a/lib/modules/manager/gradle-wrapper/artifacts.spec.ts b/lib/modules/manager/gradle-wrapper/artifacts.spec.ts
index 91da44903745e9bd8c4d0990f5e41401608d95ba..bd9e7349f9a3fdffea15730293f8b1a28da322d3 100644
--- a/lib/modules/manager/gradle-wrapper/artifacts.spec.ts
+++ b/lib/modules/manager/gradle-wrapper/artifacts.spec.ts
@@ -181,7 +181,11 @@ describe('modules/manager/gradle-wrapper/artifacts', () => {
           modified: ['gradle/wrapper/gradle-wrapper.properties'],
         })
       );
-      GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+      GlobalConfig.set({
+        ...adminConfig,
+        binarySource: 'docker',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+      });
 
       const result = await updateArtifacts({
         packageFileName: 'gradle/wrapper/gradle-wrapper.properties',
@@ -200,7 +204,7 @@ describe('modules/manager/gradle-wrapper/artifacts', () => {
         },
       ]);
       expect(execSnapshots).toMatchObject([
-        { cmd: 'docker pull containerbase/sidecar' },
+        { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
         { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
         {
           cmd:
@@ -211,7 +215,7 @@ describe('modules/manager/gradle-wrapper/artifacts', () => {
             '-e BUILDPACK_CACHE_DIR ' +
             '-e CONTAINERBASE_CACHE_DIR ' +
             '-w "/tmp/github/some/repo" ' +
-            'containerbase/sidecar' +
+            'ghcr.io/containerbase/sidecar' +
             ' bash -l -c "' +
             'install-tool java 11.0.1' +
             ' && ' +
diff --git a/lib/modules/manager/gradle/artifacts.spec.ts b/lib/modules/manager/gradle/artifacts.spec.ts
index f52fcf0d27be2a10904f3525e6224eb74823c53b..6318b887d3d2512c118b7cebccca790675179f79 100644
--- a/lib/modules/manager/gradle/artifacts.spec.ts
+++ b/lib/modules/manager/gradle/artifacts.spec.ts
@@ -35,6 +35,7 @@ const adminConfig: RepoGlobalConfig = {
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/cache'),
   containerbaseDir: join('/tmp/cache/containerbase'),
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
 };
 
 const osPlatformSpy = jest.spyOn(os, 'platform');
@@ -326,7 +327,7 @@ describe('modules/manager/gradle/artifacts', () => {
       },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -337,7 +338,7 @@ describe('modules/manager/gradle/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool java 16.0.1' +
           ' && ' +
@@ -355,7 +356,7 @@ describe('modules/manager/gradle/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool java 16.0.1' +
           ' && ' +
diff --git a/lib/modules/manager/helmfile/artifacts.spec.ts b/lib/modules/manager/helmfile/artifacts.spec.ts
index d36b45bda5b662cabc5fa961245da4c21c14af82..9cb6ec3788c62b7dd583c2a3c0c875b716c7b6ee 100644
--- a/lib/modules/manager/helmfile/artifacts.spec.ts
+++ b/lib/modules/manager/helmfile/artifacts.spec.ts
@@ -24,6 +24,7 @@ const adminConfig: RepoGlobalConfig = {
   localDir: join('/tmp/github/some/repo'), // `join` fixes Windows CI
   cacheDir: join('/tmp/renovate/cache'),
   containerbaseDir: join('/tmp/renovate/cache/containerbase'),
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
 };
 
 const config: UpdateArtifactsConfig = {};
@@ -307,7 +308,7 @@ describe('modules/manager/helmfile/artifacts', () => {
     {
       binarySource: 'docker',
       expectedCommands: [
-        { cmd: 'docker pull containerbase/sidecar' },
+        { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
         { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
         {
           cmd:
@@ -321,7 +322,7 @@ describe('modules/manager/helmfile/artifacts', () => {
             '-e BUILDPACK_CACHE_DIR ' +
             '-e CONTAINERBASE_CACHE_DIR ' +
             '-w "/tmp/github/some/repo" ' +
-            'containerbase/sidecar ' +
+            'ghcr.io/containerbase/sidecar ' +
             'bash -l -c "' +
             'install-tool helm v3.7.2' +
             ' && ' +
diff --git a/lib/modules/manager/helmv3/__snapshots__/artifacts.spec.ts.snap b/lib/modules/manager/helmv3/__snapshots__/artifacts.spec.ts.snap
index e3580be7b905cee57d54a148a55a0a9b9fe88620..f4e5d2e08f49c69ea69fff41bc310263c4bd4696 100644
--- a/lib/modules/manager/helmv3/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/modules/manager/helmv3/__snapshots__/artifacts.spec.ts.snap
@@ -456,7 +456,7 @@ exports[`modules/manager/helmv3/artifacts returns updated Chart.lock for lockfil
 exports[`modules/manager/helmv3/artifacts returns updated Chart.lock with docker 1`] = `
 [
   {
-    "cmd": "docker pull containerbase/sidecar",
+    "cmd": "docker pull ghcr.io/containerbase/sidecar",
     "options": {
       "encoding": "utf-8",
     },
@@ -468,7 +468,7 @@ exports[`modules/manager/helmv3/artifacts returns updated Chart.lock with docker
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e HELM_EXPERIMENTAL_OCI -e HELM_REGISTRY_CONFIG -e HELM_REPOSITORY_CONFIG -e HELM_REPOSITORY_CACHE -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool helm v3.7.2 && helm repo add repo-test https://gitlab.com/api/v4/projects/xxxxxxx/packages/helm/stable && helm dependency update ''"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e HELM_EXPERIMENTAL_OCI -e HELM_REGISTRY_CONFIG -e HELM_REPOSITORY_CONFIG -e HELM_REPOSITORY_CACHE -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool helm v3.7.2 && helm repo add repo-test https://gitlab.com/api/v4/projects/xxxxxxx/packages/helm/stable && helm dependency update ''"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -590,7 +590,7 @@ exports[`modules/manager/helmv3/artifacts sets repositories from registryAliases
 exports[`modules/manager/helmv3/artifacts sets repositories from registryAliases with docker 1`] = `
 [
   {
-    "cmd": "docker pull containerbase/sidecar",
+    "cmd": "docker pull ghcr.io/containerbase/sidecar",
     "options": {
       "encoding": "utf-8",
     },
@@ -602,7 +602,7 @@ exports[`modules/manager/helmv3/artifacts sets repositories from registryAliases
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e HELM_EXPERIMENTAL_OCI -e HELM_REGISTRY_CONFIG -e HELM_REPOSITORY_CONFIG -e HELM_REPOSITORY_CACHE -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool helm v3.7.2 && helm repo add stable the_stable_url && helm repo add repo1 the_repo1_url && helm repo add repo-test https://gitlab.com/api/v4/projects/xxxxxxx/packages/helm/stable && helm dependency update ''"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e HELM_EXPERIMENTAL_OCI -e HELM_REGISTRY_CONFIG -e HELM_REPOSITORY_CONFIG -e HELM_REPOSITORY_CACHE -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool helm v3.7.2 && helm repo add stable the_stable_url && helm repo add repo1 the_repo1_url && helm repo add repo-test https://gitlab.com/api/v4/projects/xxxxxxx/packages/helm/stable && helm dependency update ''"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/modules/manager/helmv3/artifacts.spec.ts b/lib/modules/manager/helmv3/artifacts.spec.ts
index 0116d6b7c65820e2d4c9b442d5f0fd6d8745aaab..ff8e5b3ee941538f86ad981fd11cc6af753a5a21 100644
--- a/lib/modules/manager/helmv3/artifacts.spec.ts
+++ b/lib/modules/manager/helmv3/artifacts.spec.ts
@@ -153,7 +153,11 @@ describe('modules/manager/helmv3/artifacts', () => {
   });
 
   it('returns updated Chart.lock with docker', async () => {
-    GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+    GlobalConfig.set({
+      ...adminConfig,
+      binarySource: 'docker',
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+    });
     fs.getSiblingFileName.mockReturnValueOnce('Chart.lock');
     fs.readLocalFile.mockResolvedValueOnce(ociLockFile1 as never);
     const execSnapshots = mockExecAll();
@@ -585,7 +589,11 @@ describe('modules/manager/helmv3/artifacts', () => {
   });
 
   it('sets repositories from registryAliases with docker', async () => {
-    GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+    GlobalConfig.set({
+      ...adminConfig,
+      binarySource: 'docker',
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+    });
     fs.getSiblingFileName.mockReturnValueOnce('Chart.lock');
     fs.readLocalFile.mockResolvedValueOnce(ociLockFile1 as never);
     const execSnapshots = mockExecAll();
diff --git a/lib/modules/manager/maven-wrapper/artifacts.spec.ts b/lib/modules/manager/maven-wrapper/artifacts.spec.ts
index a4a8c91a2fd697213465d128b460f28044397d1f..359919d3a1eae822efd5e70cc42749836c602d31 100644
--- a/lib/modules/manager/maven-wrapper/artifacts.spec.ts
+++ b/lib/modules/manager/maven-wrapper/artifacts.spec.ts
@@ -174,7 +174,11 @@ describe('modules/manager/maven-wrapper/artifacts', () => {
 
   it('updates with docker', async () => {
     mockMavenFileChangedInGit();
-    GlobalConfig.set({ localDir: './', binarySource: 'docker' });
+    GlobalConfig.set({
+      localDir: './',
+      binarySource: 'docker',
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+    });
     const execSnapshots = mockExecAll({ stdout: '', stderr: '' });
     const result = await updateArtifacts({
       packageFileName: 'maven',
@@ -193,7 +197,7 @@ describe('modules/manager/maven-wrapper/artifacts', () => {
     ]);
     expect(execSnapshots).toMatchObject([
       {
-        cmd: 'docker pull containerbase/sidecar',
+        cmd: 'docker pull ghcr.io/containerbase/sidecar',
         options: { encoding: 'utf-8' },
       },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
@@ -204,7 +208,7 @@ describe('modules/manager/maven-wrapper/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "../.." ' +
-          'containerbase/sidecar' +
+          'ghcr.io/containerbase/sidecar' +
           ' bash -l -c "' +
           'install-tool java 17.0.0 ' +
           '&& ' +
diff --git a/lib/modules/manager/mix/__snapshots__/artifacts.spec.ts.snap b/lib/modules/manager/mix/__snapshots__/artifacts.spec.ts.snap
index 903275a1220f48a8c90aa1a2e00c5f5e2d5e99de..4741c076830db33095a91a837d36a3ed98f7fb76 100644
--- a/lib/modules/manager/mix/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/modules/manager/mix/__snapshots__/artifacts.spec.ts.snap
@@ -21,7 +21,7 @@ exports[`modules/manager/mix/artifacts authenticates to private repositories 2`]
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/cache":"/tmp/cache" -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool erlang 25.0.0.0 && install-tool elixir v1.13.4 && mix hex.organization auth renovate_test --key valid_test_token && mix deps.update private_package other_package"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/cache":"/tmp/cache" -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool erlang 25.0.0.0 && install-tool elixir v1.13.4 && mix hex.organization auth renovate_test --key valid_test_token && mix deps.update private_package other_package"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -69,7 +69,7 @@ exports[`modules/manager/mix/artifacts returns null if unchanged 1`] = `
 exports[`modules/manager/mix/artifacts returns updated mix.lock 1`] = `
 [
   {
-    "cmd": "docker pull containerbase/sidecar",
+    "cmd": "docker pull ghcr.io/containerbase/sidecar",
     "options": {
       "encoding": "utf-8",
     },
@@ -81,7 +81,7 @@ exports[`modules/manager/mix/artifacts returns updated mix.lock 1`] = `
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/cache":"/tmp/cache" -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool erlang 25.0.0.0 && install-tool elixir 1.13.4 && mix deps.update plug"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/cache":"/tmp/cache" -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool erlang 25.0.0.0 && install-tool elixir 1.13.4 && mix deps.update plug"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/modules/manager/mix/artifacts.spec.ts b/lib/modules/manager/mix/artifacts.spec.ts
index 29801cb9371d68c09388c4cbae9719516a00ee2d..63a5576810aec469ebbc8e9a090b6756c2c84cdb 100644
--- a/lib/modules/manager/mix/artifacts.spec.ts
+++ b/lib/modules/manager/mix/artifacts.spec.ts
@@ -90,7 +90,11 @@ describe('modules/manager/mix/artifacts', () => {
 
   it('returns updated mix.lock', async () => {
     jest.spyOn(docker, 'removeDanglingContainers').mockResolvedValueOnce();
-    GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+    GlobalConfig.set({
+      ...adminConfig,
+      binarySource: 'docker',
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+    });
     fs.readLocalFile.mockResolvedValueOnce('Old mix.lock');
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('mix.lock');
     const execSnapshots = mockExecAll();
@@ -161,7 +165,11 @@ describe('modules/manager/mix/artifacts', () => {
 
   it('authenticates to private repositories', async () => {
     jest.spyOn(docker, 'removeDanglingContainers').mockResolvedValueOnce();
-    GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+    GlobalConfig.set({
+      ...adminConfig,
+      binarySource: 'docker',
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+    });
     fs.readLocalFile.mockResolvedValueOnce('Old mix.lock');
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('mix.lock');
     const execSnapshots = mockExecAll();
@@ -221,7 +229,11 @@ describe('modules/manager/mix/artifacts', () => {
   });
 
   it('returns updated mix.lock in subdir', async () => {
-    GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+    GlobalConfig.set({
+      ...adminConfig,
+      binarySource: 'docker',
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+    });
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('subdir/mix.lock');
     mockExecAll();
     expect(
diff --git a/lib/modules/manager/nix/artifacts.spec.ts b/lib/modules/manager/nix/artifacts.spec.ts
index 35509270490ec98c7e7a1e82b72a95429fc63731..0877831a67938768160fc3b440f03b5fee04d4a3 100644
--- a/lib/modules/manager/nix/artifacts.spec.ts
+++ b/lib/modules/manager/nix/artifacts.spec.ts
@@ -24,7 +24,11 @@ const adminConfig: RepoGlobalConfig = {
   cacheDir: join('/tmp/renovate/cache'),
   containerbaseDir: join('/tmp/renovate/cache/containerbase'),
 };
-const dockerAdminConfig = { ...adminConfig, binarySource: 'docker' };
+const dockerAdminConfig = {
+  ...adminConfig,
+  binarySource: 'docker',
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+};
 
 process.env.BUILDPACK = 'true';
 
@@ -177,7 +181,7 @@ describe('modules/manager/nix/artifacts', () => {
       },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -187,7 +191,7 @@ describe('modules/manager/nix/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar ' +
+          'ghcr.io/containerbase/sidecar ' +
           'bash -l -c "' +
           'install-tool nix 2.10.0 ' +
           '&& ' +
@@ -308,7 +312,7 @@ describe('modules/manager/nix/artifacts', () => {
       },
     ]);
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -318,7 +322,7 @@ describe('modules/manager/nix/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar ' +
+          'ghcr.io/containerbase/sidecar ' +
           'bash -l -c "' +
           'install-tool nix 2.10.0 ' +
           '&& ' +
diff --git a/lib/modules/manager/npm/post-update/lerna.spec.ts b/lib/modules/manager/npm/post-update/lerna.spec.ts
index 3ecb66e879f74626c12c541804e1d1f20f5108e4..69e88d45da0f910fe4bd83e486956d82d5604489 100644
--- a/lib/modules/manager/npm/post-update/lerna.spec.ts
+++ b/lib/modules/manager/npm/post-update/lerna.spec.ts
@@ -134,7 +134,11 @@ describe('modules/manager/npm/post-update/lerna', () => {
 
     it('suppports docker', async () => {
       const execSnapshots = mockExecAll();
-      GlobalConfig.set({ ...globalConfig, binarySource: 'docker' });
+      GlobalConfig.set({
+        ...globalConfig,
+        binarySource: 'docker',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+      });
 
       const res = await lernaHelper.generateLockFiles(
         lernaPkgFile('npm'),
@@ -144,7 +148,7 @@ describe('modules/manager/npm/post-update/lerna', () => {
       );
       expect(execSnapshots).toMatchObject([
         {
-          cmd: 'docker pull containerbase/sidecar',
+          cmd: 'docker pull ghcr.io/containerbase/sidecar',
         },
         {
           cmd: 'docker ps --filter name=renovate_sidecar -aq',
@@ -155,7 +159,7 @@ describe('modules/manager/npm/post-update/lerna', () => {
             '-v "/tmp/cache":"/tmp/cache" ' +
             '-e BUILDPACK_CACHE_DIR ' +
             '-e CONTAINERBASE_CACHE_DIR ' +
-            '-w "some-dir" containerbase/sidecar ' +
+            '-w "some-dir" ghcr.io/containerbase/sidecar ' +
             'bash -l -c "' +
             'install-tool node 16.16.0 ' +
             '&& ' +
diff --git a/lib/modules/manager/npm/post-update/npm.spec.ts b/lib/modules/manager/npm/post-update/npm.spec.ts
index 42d4851b9781e686735cf7f14b229b39cf1b7876..ff0f453b6635bbb3c14c1396a943457de4fc08ca 100644
--- a/lib/modules/manager/npm/post-update/npm.spec.ts
+++ b/lib/modules/manager/npm/post-update/npm.spec.ts
@@ -246,6 +246,7 @@ describe('modules/manager/npm/post-update/npm', () => {
       cacheDir: '/tmp',
       binarySource: 'docker',
       allowScripts: true,
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
     });
     const execSnapshots = mockExecAll();
     fs.readLocalFile.mockResolvedValue('package-lock-contents');
@@ -259,7 +260,7 @@ describe('modules/manager/npm/post-update/npm', () => {
     expect(fs.readLocalFile).toHaveBeenCalledTimes(1);
     expect(res.lockFile).toBe('package-lock-contents');
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -268,7 +269,7 @@ describe('modules/manager/npm/post-update/npm', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "some-dir" ' +
-          'containerbase/sidecar ' +
+          'ghcr.io/containerbase/sidecar ' +
           'bash -l -c "' +
           'install-tool node 16.16.0 ' +
           '&& ' +
diff --git a/lib/modules/manager/npm/post-update/pnpm.spec.ts b/lib/modules/manager/npm/post-update/pnpm.spec.ts
index 5acd7a58a4a63c8934fc395fa8011af5c439cb94..e3a9fe79ebec238c5a6370cb7ab4e5dc1774afb3 100644
--- a/lib/modules/manager/npm/post-update/pnpm.spec.ts
+++ b/lib/modules/manager/npm/post-update/pnpm.spec.ts
@@ -213,6 +213,7 @@ describe('modules/manager/npm/post-update/pnpm', () => {
       cacheDir: '/tmp',
       binarySource: 'docker',
       allowScripts: true,
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
     });
     const execSnapshots = mockExecAll();
     fs.readLocalFile.mockResolvedValue('package-lock-contents');
@@ -224,7 +225,7 @@ describe('modules/manager/npm/post-update/pnpm', () => {
     expect(fs.readLocalFile).toHaveBeenCalledTimes(1);
     expect(res.lockFile).toBe('package-lock-contents');
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -233,7 +234,7 @@ describe('modules/manager/npm/post-update/pnpm', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "some-dir" ' +
-          'containerbase/sidecar ' +
+          'ghcr.io/containerbase/sidecar ' +
           'bash -l -c "' +
           'install-tool node 16.16.0 ' +
           '&& install-tool pnpm 6.0.0 ' +
diff --git a/lib/modules/manager/npm/post-update/yarn.spec.ts b/lib/modules/manager/npm/post-update/yarn.spec.ts
index 3a52566194255941fd254f9980b8acb33539284a..997bd070438447627921919a71ac75da8a90e24f 100644
--- a/lib/modules/manager/npm/post-update/yarn.spec.ts
+++ b/lib/modules/manager/npm/post-update/yarn.spec.ts
@@ -536,6 +536,7 @@ describe('modules/manager/npm/post-update/yarn', () => {
       localDir: '.',
       binarySource: 'docker',
       cacheDir: '/tmp/cache',
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
     });
     Fixtures.mock(
       {
@@ -555,10 +556,10 @@ describe('modules/manager/npm/post-update/yarn', () => {
     expect(res.lockFile).toBe(plocktest1YarnLockV1);
     const options = { encoding: 'utf-8' };
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar', options },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar', options },
       {
         cmd:
-          `docker run --rm --name=renovate_sidecar --label=renovate_child -v ".":"." -v "/tmp/cache":"/tmp/cache" -e CI -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "some-dir" containerbase/sidecar ` +
+          `docker run --rm --name=renovate_sidecar --label=renovate_child -v ".":"." -v "/tmp/cache":"/tmp/cache" -e CI -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "some-dir" ghcr.io/containerbase/sidecar ` +
           `bash -l -c "` +
           `install-tool node 16.16.0` +
           ` && ` +
diff --git a/lib/modules/manager/nuget/artifacts.spec.ts b/lib/modules/manager/nuget/artifacts.spec.ts
index 5520b23a89ea87cc64a09b813d72bb363edf48e1..d950b750df16d90d451028f54b000cff3003fd2b 100644
--- a/lib/modules/manager/nuget/artifacts.spec.ts
+++ b/lib/modules/manager/nuget/artifacts.spec.ts
@@ -222,7 +222,11 @@ describe('modules/manager/nuget/artifacts', () => {
   });
 
   it('supports docker mode', async () => {
-    GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+    GlobalConfig.set({
+      ...adminConfig,
+      binarySource: 'docker',
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+    });
     const execSnapshots = mockExecAll();
     fs.getSiblingFileName.mockReturnValueOnce('packages.lock.json');
     git.getFiles.mockResolvedValueOnce({
@@ -249,7 +253,7 @@ describe('modules/manager/nuget/artifacts', () => {
     ]);
     expect(execSnapshots).toMatchObject([
       {
-        cmd: 'docker pull containerbase/sidecar',
+        cmd: 'docker pull ghcr.io/containerbase/sidecar',
       },
       {
         cmd: 'docker ps --filter name=renovate_sidecar -aq',
@@ -264,7 +268,7 @@ describe('modules/manager/nuget/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar ' +
+          'ghcr.io/containerbase/sidecar ' +
           'bash -l -c "' +
           'install-tool dotnet 7.0.100' +
           ' && ' +
diff --git a/lib/modules/manager/pep621/artifacts.spec.ts b/lib/modules/manager/pep621/artifacts.spec.ts
index d28645cf794350af105895307cf87cac7a80d20f..717a03899c64ea72ce52eb15dabea32e5dc017fd 100644
--- a/lib/modules/manager/pep621/artifacts.spec.ts
+++ b/lib/modules/manager/pep621/artifacts.spec.ts
@@ -58,7 +58,11 @@ describe('modules/manager/pep621/artifacts', () => {
 
     it('return processor result', async () => {
       const execSnapshots = mockExecAll();
-      GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+      GlobalConfig.set({
+        ...adminConfig,
+        binarySource: 'docker',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+      });
       fs.getSiblingFileName.mockReturnValueOnce('pdm.lock');
       fs.readLocalFile.mockResolvedValueOnce('old test content');
       fs.readLocalFile.mockResolvedValueOnce('new test content');
@@ -98,7 +102,7 @@ requires-python = "<3.9"
       ]);
       expect(execSnapshots).toMatchObject([
         {
-          cmd: 'docker pull containerbase/sidecar',
+          cmd: 'docker pull ghcr.io/containerbase/sidecar',
           options: {
             encoding: 'utf-8',
           },
@@ -117,7 +121,7 @@ requires-python = "<3.9"
             '-e BUILDPACK_CACHE_DIR ' +
             '-e CONTAINERBASE_CACHE_DIR ' +
             '-w "/tmp/github/some/repo" ' +
-            'containerbase/sidecar ' +
+            'ghcr.io/containerbase/sidecar ' +
             'bash -l -c "' +
             'install-tool python 3.8.1 ' +
             '&& ' +
diff --git a/lib/modules/manager/pep621/processors/pdm.spec.ts b/lib/modules/manager/pep621/processors/pdm.spec.ts
index 4e1c77a1f4ae4c797c36676a82a58f2ac745343b..54d028b26b72f9eb3c89e0729831ec5333fe6329 100644
--- a/lib/modules/manager/pep621/processors/pdm.spec.ts
+++ b/lib/modules/manager/pep621/processors/pdm.spec.ts
@@ -41,7 +41,11 @@ describe('modules/manager/pep621/processors/pdm', () => {
 
     it('return null if the lock file is unchanged', async () => {
       const execSnapshots = mockExecAll();
-      GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+      GlobalConfig.set({
+        ...adminConfig,
+        binarySource: 'docker',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+      });
       fs.getSiblingFileName.mockReturnValueOnce('pdm.lock');
       fs.readLocalFile.mockResolvedValueOnce('test content');
       fs.readLocalFile.mockResolvedValueOnce('test content');
@@ -67,7 +71,7 @@ describe('modules/manager/pep621/processors/pdm', () => {
       expect(result).toBeNull();
       expect(execSnapshots).toMatchObject([
         {
-          cmd: 'docker pull containerbase/sidecar',
+          cmd: 'docker pull ghcr.io/containerbase/sidecar',
         },
         {
           cmd: 'docker ps --filter name=renovate_sidecar -aq',
@@ -80,7 +84,7 @@ describe('modules/manager/pep621/processors/pdm', () => {
             '-e BUILDPACK_CACHE_DIR ' +
             '-e CONTAINERBASE_CACHE_DIR ' +
             '-w "/tmp/github/some/repo" ' +
-            'containerbase/sidecar ' +
+            'ghcr.io/containerbase/sidecar ' +
             'bash -l -c "' +
             'install-tool python 3.11.2 ' +
             '&& ' +
diff --git a/lib/modules/manager/pip-compile/artifacts.spec.ts b/lib/modules/manager/pip-compile/artifacts.spec.ts
index b410cbce2a310b44ac535fc9f30622014269d96d..e9ac229bece2deec5abc910c2a2b580f94606bd1 100644
--- a/lib/modules/manager/pip-compile/artifacts.spec.ts
+++ b/lib/modules/manager/pip-compile/artifacts.spec.ts
@@ -27,7 +27,11 @@ const adminConfig: RepoGlobalConfig = {
   cacheDir: join('/tmp/renovate/cache'),
   containerbaseDir: join('/tmp/renovate/cache/containerbase'),
 };
-const dockerAdminConfig = { ...adminConfig, binarySource: 'docker' };
+const dockerAdminConfig = {
+  ...adminConfig,
+  binarySource: 'docker',
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+};
 
 process.env.BUILDPACK = 'true';
 
@@ -122,7 +126,7 @@ describe('modules/manager/pip-compile/artifacts', () => {
     ).not.toBeNull();
 
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -133,7 +137,7 @@ describe('modules/manager/pip-compile/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar ' +
+          'ghcr.io/containerbase/sidecar ' +
           'bash -l -c "' +
           'install-tool python 3.10.2 ' +
           '&& ' +
@@ -247,7 +251,7 @@ describe('modules/manager/pip-compile/artifacts', () => {
     ).not.toBeNull();
 
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -258,7 +262,7 @@ describe('modules/manager/pip-compile/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar ' +
+          'ghcr.io/containerbase/sidecar ' +
           'bash -l -c "' +
           'install-tool python 3.10.2 ' +
           '&& ' +
diff --git a/lib/modules/manager/pip_requirements/artifacts.spec.ts b/lib/modules/manager/pip_requirements/artifacts.spec.ts
index adaeacf6d35df9b58176a0cbae41acd4fdabdcd5..e8fbbf585cea1d88e51922be93d6a41339ffd43f 100644
--- a/lib/modules/manager/pip_requirements/artifacts.spec.ts
+++ b/lib/modules/manager/pip_requirements/artifacts.spec.ts
@@ -187,7 +187,11 @@ describe('modules/manager/pip_requirements/artifacts', () => {
   });
 
   it('supports docker mode', async () => {
-    GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+    GlobalConfig.set({
+      ...adminConfig,
+      binarySource: 'docker',
+      dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+    });
     fs.readLocalFile.mockResolvedValueOnce('new content');
     fs.ensureCacheDir.mockResolvedValueOnce('/tmp/cache');
     // hashin
@@ -214,7 +218,7 @@ describe('modules/manager/pip_requirements/artifacts', () => {
     ]);
 
     expect(execSnapshots).toMatchObject([
-      { cmd: 'docker pull containerbase/sidecar' },
+      { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
       { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
       {
         cmd:
@@ -225,7 +229,7 @@ describe('modules/manager/pip_requirements/artifacts', () => {
           '-e BUILDPACK_CACHE_DIR ' +
           '-e CONTAINERBASE_CACHE_DIR ' +
           '-w "/tmp/github/some/repo" ' +
-          'containerbase/sidecar ' +
+          'ghcr.io/containerbase/sidecar ' +
           'bash -l -c "' +
           'install-tool python 3.10.2 ' +
           '&& ' +
diff --git a/lib/modules/manager/pipenv/__snapshots__/artifacts.spec.ts.snap b/lib/modules/manager/pipenv/__snapshots__/artifacts.spec.ts.snap
index 184fb21b84520bbc3e65bd1506f6b78f3233a9c1..a66e1c1d655ce612ffc17e7ecc5cf1cd529e6da3 100644
--- a/lib/modules/manager/pipenv/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/modules/manager/pipenv/__snapshots__/artifacts.spec.ts.snap
@@ -99,7 +99,7 @@ exports[`modules/manager/pipenv/artifacts returns updated Pipfile.lock 1`] = `
 exports[`modules/manager/pipenv/artifacts supports docker mode 1`] = `
 [
   {
-    "cmd": "docker pull containerbase/sidecar",
+    "cmd": "docker pull ghcr.io/containerbase/sidecar",
     "options": {
       "encoding": "utf-8",
     },
@@ -111,7 +111,7 @@ exports[`modules/manager/pipenv/artifacts supports docker mode 1`] = `
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e PIPENV_CACHE_DIR -e PIP_CACHE_DIR -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool python 3.7.6 && install-tool pipenv 2023.1.2 && pipenv lock"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e PIPENV_CACHE_DIR -e PIP_CACHE_DIR -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool python 3.7.6 && install-tool pipenv 2023.1.2 && pipenv lock"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -138,7 +138,7 @@ exports[`modules/manager/pipenv/artifacts supports docker mode 1`] = `
 exports[`modules/manager/pipenv/artifacts uses pipenv version from Pipfile 1`] = `
 [
   {
-    "cmd": "docker pull containerbase/sidecar",
+    "cmd": "docker pull ghcr.io/containerbase/sidecar",
     "options": {
       "encoding": "utf-8",
     },
@@ -150,7 +150,7 @@ exports[`modules/manager/pipenv/artifacts uses pipenv version from Pipfile 1`] =
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool python 3.10.2 && install-tool pipenv 2020.8.13 && pipenv lock"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool python 3.10.2 && install-tool pipenv 2020.8.13 && pipenv lock"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -176,7 +176,7 @@ exports[`modules/manager/pipenv/artifacts uses pipenv version from Pipfile 1`] =
 exports[`modules/manager/pipenv/artifacts uses pipenv version from Pipfile dev packages 1`] = `
 [
   {
-    "cmd": "docker pull containerbase/sidecar",
+    "cmd": "docker pull ghcr.io/containerbase/sidecar",
     "options": {
       "encoding": "utf-8",
     },
@@ -188,7 +188,7 @@ exports[`modules/manager/pipenv/artifacts uses pipenv version from Pipfile dev p
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool python 3.10.2 && install-tool pipenv 2020.8.13 && pipenv lock"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool python 3.10.2 && install-tool pipenv 2020.8.13 && pipenv lock"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -214,7 +214,7 @@ exports[`modules/manager/pipenv/artifacts uses pipenv version from Pipfile dev p
 exports[`modules/manager/pipenv/artifacts uses pipenv version from config 1`] = `
 [
   {
-    "cmd": "docker pull containerbase/sidecar",
+    "cmd": "docker pull ghcr.io/containerbase/sidecar",
     "options": {
       "encoding": "utf-8",
     },
@@ -226,7 +226,7 @@ exports[`modules/manager/pipenv/artifacts uses pipenv version from config 1`] =
     },
   },
   {
-    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" containerbase/sidecar bash -l -c "install-tool python 3.10.2 && install-tool pipenv 2020.1.1 && pipenv lock"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v "/tmp/github/some/repo":"/tmp/github/some/repo" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -e CONTAINERBASE_CACHE_DIR -w "/tmp/github/some/repo" ghcr.io/containerbase/sidecar bash -l -c "install-tool python 3.10.2 && install-tool pipenv 2020.1.1 && pipenv lock"",
     "options": {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/modules/manager/pipenv/artifacts.spec.ts b/lib/modules/manager/pipenv/artifacts.spec.ts
index 5f8d14acd0be4c1c549b87f41e4748bcb5070244..40f2a7c43a5df643f8eb79e0299aca261afcb023 100644
--- a/lib/modules/manager/pipenv/artifacts.spec.ts
+++ b/lib/modules/manager/pipenv/artifacts.spec.ts
@@ -36,7 +36,11 @@ const adminConfig: RepoGlobalConfig = {
   cacheDir: join('/tmp/renovate/cache'),
   containerbaseDir: join('/tmp/renovate/cache/containerbase'),
 };
-const dockerAdminConfig = { ...adminConfig, binarySource: 'docker' };
+const dockerAdminConfig = {
+  ...adminConfig,
+  binarySource: 'docker',
+  dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+};
 
 const config: UpdateArtifactsConfig = {};
 const lockMaintenanceConfig = { ...config, isLockFileMaintenance: true };
diff --git a/lib/modules/manager/poetry/artifacts.spec.ts b/lib/modules/manager/poetry/artifacts.spec.ts
index 67cc4098f841dd34028a68856fd85f7bc47720a6..d09a0908d7a55209aad72374504ec3599751ad7a 100644
--- a/lib/modules/manager/poetry/artifacts.spec.ts
+++ b/lib/modules/manager/poetry/artifacts.spec.ts
@@ -250,7 +250,11 @@ describe('modules/manager/poetry/artifacts', () => {
     });
 
     it('returns updated poetry.lock using docker', async () => {
-      GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+      GlobalConfig.set({
+        ...adminConfig,
+        binarySource: 'docker',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+      });
       const execSnapshots = mockExecAll();
       fs.ensureCacheDir.mockResolvedValueOnce('/tmp/renovate/cache/others/pip');
       // poetry.lock
@@ -288,7 +292,7 @@ describe('modules/manager/poetry/artifacts', () => {
         },
       ]);
       expect(execSnapshots).toMatchObject([
-        { cmd: 'docker pull containerbase/sidecar' },
+        { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
         { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
         {
           cmd:
@@ -299,7 +303,7 @@ describe('modules/manager/poetry/artifacts', () => {
             '-e BUILDPACK_CACHE_DIR ' +
             '-e CONTAINERBASE_CACHE_DIR ' +
             '-w "/tmp/github/some/repo" ' +
-            'containerbase/sidecar ' +
+            'ghcr.io/containerbase/sidecar ' +
             'bash -l -c "' +
             'install-tool python 3.4.2 ' +
             '&& ' +
@@ -312,7 +316,11 @@ describe('modules/manager/poetry/artifacts', () => {
     });
 
     it('returns updated poetry.lock using docker (constraints)', async () => {
-      GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+      GlobalConfig.set({
+        ...adminConfig,
+        binarySource: 'docker',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+      });
       const execSnapshots = mockExecAll();
 
       fs.ensureCacheDir.mockResolvedValueOnce('/tmp/renovate/cache/others/pip');
@@ -351,7 +359,7 @@ describe('modules/manager/poetry/artifacts', () => {
         },
       ]);
       expect(execSnapshots).toMatchObject([
-        { cmd: 'docker pull containerbase/sidecar' },
+        { cmd: 'docker pull ghcr.io/containerbase/sidecar' },
         { cmd: 'docker ps --filter name=renovate_sidecar -aq' },
         {
           cmd:
@@ -362,7 +370,7 @@ describe('modules/manager/poetry/artifacts', () => {
             '-e BUILDPACK_CACHE_DIR ' +
             '-e CONTAINERBASE_CACHE_DIR ' +
             '-w "/tmp/github/some/repo" ' +
-            'containerbase/sidecar ' +
+            'ghcr.io/containerbase/sidecar ' +
             'bash -l -c "' +
             'install-tool python 2.7.5 ' +
             '&& ' +
diff --git a/lib/modules/manager/pub/artifacts.spec.ts b/lib/modules/manager/pub/artifacts.spec.ts
index af46405b091b6edc7acf576269cd06d7206c94db..f051bb8665e04986788492f19bbb080f9a87cfbf 100644
--- a/lib/modules/manager/pub/artifacts.spec.ts
+++ b/lib/modules/manager/pub/artifacts.spec.ts
@@ -141,7 +141,11 @@ describe('modules/manager/pub/artifacts', () => {
     });
 
     it(`supports ${params.sdk} docker mode`, async () => {
-      GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
+      GlobalConfig.set({
+        ...adminConfig,
+        binarySource: 'docker',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+      });
       const execSnapshots = mockExecAll();
       fs.getSiblingFileName.mockReturnValueOnce(lockFile);
       fs.readLocalFile.mockResolvedValueOnce(oldLockFileContent);
@@ -162,7 +166,7 @@ describe('modules/manager/pub/artifacts', () => {
       ]);
       expect(execSnapshots).toMatchObject([
         {
-          cmd: 'docker pull containerbase/sidecar',
+          cmd: 'docker pull ghcr.io/containerbase/sidecar',
         },
         {
           cmd: 'docker ps --filter name=renovate_sidecar -aq',
@@ -175,7 +179,7 @@ describe('modules/manager/pub/artifacts', () => {
             '-e BUILDPACK_CACHE_DIR ' +
             '-e CONTAINERBASE_CACHE_DIR ' +
             '-w "/tmp/github/some/repo" ' +
-            'containerbase/sidecar ' +
+            'ghcr.io/containerbase/sidecar ' +
             'bash -l -c "' +
             `install-tool ${params.sdk} 3.3.9` +
             ' && ' +
diff --git a/lib/util/exec/docker/index.spec.ts b/lib/util/exec/docker/index.spec.ts
index b0a2904ab60925ab91453d36152775c3206b2632..7bf1e5ce9146ede67b17ddc6d97d1bca6744c7b2 100644
--- a/lib/util/exec/docker/index.spec.ts
+++ b/lib/util/exec/docker/index.spec.ts
@@ -226,11 +226,14 @@ describe('util/exec/docker/index', () => {
       (opts ? `${opts} ` : '') +
       `-e FOO -e BAR ` +
       `-w "/tmp/foobar" ` +
-      `containerbase/${img} ` +
+      `ghcr.io/containerbase/sidecar ` +
       `bash -l -c "foo && bar"`;
 
     beforeEach(() => {
-      GlobalConfig.set({ dockerUser: 'some-user' });
+      GlobalConfig.set({
+        dockerUser: 'some-user',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+      });
     });
 
     it('returns executable command', async () => {
@@ -268,6 +271,7 @@ describe('util/exec/docker/index', () => {
         cacheDir: '/tmp/cache',
         containerbaseDir: '/tmp/containerbase',
         dockerUser: 'some-user',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
       });
       const volumes: VolumeOption[] = ['/tmp/foo'];
       const res = await generateDockerCommand(commands, preCommands, {
@@ -288,6 +292,7 @@ describe('util/exec/docker/index', () => {
         cacheDir: '/tmp/cache',
         containerbaseDir: '/tmp/cache/containerbase',
         dockerUser: 'some-user',
+        dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
       });
       const volumes: VolumeOption[] = ['/tmp/foo'];
       const res = await generateDockerCommand(commands, preCommands, {
diff --git a/lib/util/exec/docker/index.ts b/lib/util/exec/docker/index.ts
index 65a2b4fbb0cd94164cce53247f669c5fc27829a6..a49ce0d8467bec4e542bde4fd029f5acb30db193 100644
--- a/lib/util/exec/docker/index.ts
+++ b/lib/util/exec/docker/index.ts
@@ -6,7 +6,6 @@ import { getPkgReleases } from '../../../modules/datasource';
 import * as versioning from '../../../modules/versioning';
 import { newlineRegex, regEx } from '../../regex';
 import { uniq } from '../../uniq';
-import { ensureTrailingSlash } from '../../url';
 import { rawExec } from '../common';
 import type { DockerOptions, Opt, VolumeOption, VolumesPair } from '../types';
 
@@ -218,7 +217,7 @@ export async function generateDockerCommand(
     dockerUser,
     dockerChildPrefix,
     dockerCliOptions,
-    dockerImagePrefix,
+    dockerSidecarImage,
   } = GlobalConfig.get();
   const result = ['docker run --rm'];
   const containerName = getContainerName(image, dockerChildPrefix);
@@ -258,9 +257,8 @@ export async function generateDockerCommand(
     result.push(`-w "${cwd}"`);
   }
 
-  image = `${ensureTrailingSlash(
-    dockerImagePrefix ?? 'containerbase'
-  )}${image}`;
+  // TODO: #7154
+  image = dockerSidecarImage!;
 
   // TODO: add constraint: const tag = getDockerTag(image, sideCarImageVersion, 'semver');
   logger.debug(
diff --git a/lib/util/exec/index.spec.ts b/lib/util/exec/index.spec.ts
index a72aa0ee5546df955a82f7233adfd3a8eefd9b84..d1f3444e396acbac2a7d01de591ba10a63f8aa52 100644
--- a/lib/util/exec/index.spec.ts
+++ b/lib/util/exec/index.spec.ts
@@ -38,7 +38,11 @@ describe('util/exec/index', () => {
   const defaultCacheVolume = `-v "${cacheDir}":"${cacheDir}"`;
   const defaultVolumes = `-v "${cwd}":"${cwd}" ${defaultCacheVolume}`;
 
-  const globalConfig: RepoGlobalConfig = { cacheDir, containerbaseDir };
+  const globalConfig: RepoGlobalConfig = {
+    cacheDir,
+    containerbaseDir,
+    dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
+  };
 
   beforeEach(() => {
     dockerModule.resetPrefetchedImages();
@@ -54,7 +58,7 @@ describe('util/exec/index', () => {
   });
 
   const image = dockerModule.sideCarImage;
-  const fullImage = `containerbase/${image}`;
+  const fullImage = `ghcr.io/containerbase/sidecar`;
   const name = `renovate_${image}`;
   const inCmd = 'echo hello';
   const outCmd = ['echo hello'];
@@ -432,7 +436,7 @@ describe('util/exec/index', () => {
           },
         ],
         adminConfig: {
-          dockerImagePrefix: 'ghcr.io/containerbase',
+          dockerSidecarImage: 'ghcr.io/containerbase/sidecar',
           binarySource: 'docker',
         },
       },
diff --git a/renovate.json b/renovate.json
index 86850e28adc84186bd40f36135d78305d7135b57..4824b2dfe9c9bfbea84a468ec0e2ef830d513a69 100644
--- a/renovate.json
+++ b/renovate.json
@@ -29,5 +29,14 @@
       "matchPaths": ["**/__fixtures__/**"],
       "enabled": false
     }
+  ],
+  "regexManagers": [
+    {
+      "fileMatch": ["config/options/index.ts"],
+      "matchStrings": [
+        "default: '(?<depName>ghcr.io/containerbase/sidecar):(?<currentValue>.*)'"
+      ],
+      "datasourceTemplate": "docker"
+    }
   ]
 }