diff --git a/.env.example b/.env.example
index 809e711e..dfda2baf 100644
--- a/.env.example
+++ b/.env.example
@@ -22,4 +22,4 @@ BASE_RPC_URL=wss://base-mainnet.g.alchemy.com/v2/REPLACE_ME
 
 # Optional: override the published image with a locally-built or
 # pinned-by-SHA tag. Leave unset to pull `:latest` from ghcr.io.
-# SHEPHERD_IMAGE=ghcr.io/bleu/nullis-shepherd:sha-abc1234
+# SHEPHERD_IMAGE=ghcr.io/nullislabs/shepherd:sha-abc1234
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d03d87ff..1d6fe67c 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -2,11 +2,13 @@
 #
 # Triggers:
 #   - push to `main`               → publish `latest` + `sha-<sha>`
-#   - tag push `v*`                → publish `v<tag>` + `latest`
+#   - tag push `v*`                → publish `v<tag>` + `sha-<sha>`
+#     (`latest` only moves on default-branch pushes, per the
+#     metadata-action `is_default_branch` gate below)
 #   - workflow_dispatch (manual)   → publish `manual-<run_id>`
 #   - pull_request to `main`       → build only, no push (CI smoke)
 #
-# Image: ghcr.io/<owner>/nullis-shepherd
+# Image: ghcr.io/nullislabs/shepherd
 # Auth:  GITHUB_TOKEN (scoped to packages:write below).
 #
 # Pinned action SHAs match the style of `.github/workflows/ci.yml`.
diff --git a/docker-compose.yml b/docker-compose.yml
index 3f432658..7753f19e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,7 +10,7 @@
 # The image either builds from the repo's Dockerfile (`docker compose
 # build`) or pulls the published ghcr.io artefact when the
 # `SHEPHERD_IMAGE` env var is set (CI publishes
-# `ghcr.io/bleu/nullis-shepherd:<sha>` and `:latest` on main).
+# `ghcr.io/nullislabs/shepherd:<sha>` and `:latest` on main).
 #
 # Required mounts:
 #   - ./engine.toml -> /etc/shepherd/engine.toml  (operator-supplied)
@@ -19,7 +19,7 @@
 
 services:
   shepherd:
-    image: ${SHEPHERD_IMAGE:-ghcr.io/bleu/nullis-shepherd:latest}
+    image: ${SHEPHERD_IMAGE:-ghcr.io/nullislabs/shepherd:latest}
     # Comment out `build` if you `docker compose pull` instead of
     # building from source. Leaving it lets `docker compose up
     # --build` re-build from the local checkout when the image
diff --git a/docs/deployment/docker.md b/docs/deployment/docker.md
index a01c4a4e..8112beb0 100644
--- a/docs/deployment/docker.md
+++ b/docs/deployment/docker.md
@@ -9,9 +9,9 @@ The image is published on every push to `main` and on every
 `v*` tag:
 
 ```
-ghcr.io/bleu/nullis-shepherd:latest         # main branch HEAD
-ghcr.io/bleu/nullis-shepherd:sha-<short>    # exact-build pin
-ghcr.io/bleu/nullis-shepherd:v0.2.0         # tag
+ghcr.io/nullislabs/shepherd:latest         # main branch HEAD
+ghcr.io/nullislabs/shepherd:sha-<short>    # exact-build pin
+ghcr.io/nullislabs/shepherd:v0.2.0         # tag
 ```
 
 `linux/amd64` only for now (the soak VM is x86_64; add `arm64` once
@@ -23,7 +23,7 @@ an operator surfaces a real need).
 
 ```bash
 # On the VM:
-git clone https://github.com/bleu/nullis-shepherd /opt/shepherd
+git clone https://github.com/nullislabs/shepherd /opt/shepherd
 cd /opt/shepherd
 
 # Operator-supplied RPC URLs. `.env` is gitignored; the template
@@ -126,12 +126,12 @@ docker compose up -d              # picks up the new image; graceful
                                   # before the new container takes over.
 
 # Roll back to a specific build.
-export SHEPHERD_IMAGE=ghcr.io/bleu/nullis-shepherd:sha-abc1234
+export SHEPHERD_IMAGE=ghcr.io/nullislabs/shepherd:sha-abc1234
 docker compose up -d
 
 # Cold roll: stop, prune image, pull fresh.
 docker compose down
-docker image rm ghcr.io/bleu/nullis-shepherd:latest
+docker image rm ghcr.io/nullislabs/shepherd:latest
 docker compose pull && docker compose up -d
 ```
 
diff --git a/docs/production.md b/docs/production.md
index 3296cf99..2bb33ef1 100644
--- a/docs/production.md
+++ b/docs/production.md
@@ -56,7 +56,7 @@ Before launching:
 ```ini
 [Unit]
 Description=Shepherd (nexum) - CoW Protocol off-chain automation runtime
-Documentation=https://github.com/bleu/nullis-shepherd
+Documentation=https://github.com/nullislabs/shepherd
 After=network-online.target
 Wants=network-online.target