diff --git a/sdk_container/src/third_party/coreos-overlay/.github/workflows/mirror-calico.sh b/sdk_container/src/third_party/coreos-overlay/.github/workflows/mirror-calico.sh
new file mode 100755
index 0000000000..33de9255f1
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/.github/workflows/mirror-calico.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# This script will mirror the list of Calico images
+# from Docker Hub to GHCR.
+
+# tag will hold the version of calico images we
+# previously fetched
+tag=$1
+
+# list of images to mirror from Docker Hub
+images=(
+  calico/typha
+  calico/pod2daemon-flexvol
+  calico/cni
+  calico/node
+  calico/kube-controllers
+)
+
+# we iterate over the images we want to mirror
+for image in "${images[@]}"; do
+  ./mirror-to-ghcr.sh $image $tag
+done
diff --git a/sdk_container/src/third_party/coreos-overlay/.github/workflows/mirror-to-ghcr.sh b/sdk_container/src/third_party/coreos-overlay/.github/workflows/mirror-to-ghcr.sh
new file mode 100755
index 0000000000..5aa865186a
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/.github/workflows/mirror-to-ghcr.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# This generic script aims to mirror an image from Docker hub to another registry.
+# Authentication to the registry must be done before.
+
+image=$1
+imagetag=$2
+registry=${3:-kinvolk}
+
+# we want both arch for running tests
+platforms=( amd64 arm64 )
+
+# tags will hold the mirrored images
+tags=()
+
+for platform in "${platforms[@]}"; do
+  # we first fetch the image from Docker Hub
+  var=$(docker pull $image:$imagetag --platform=linux/$platform -q)
+  # we prepare the image to be pushed into another registry
+  tag=ghcr.io/$registry/$image:$imagetag-$platform
+  # we tag the image to create the mirrored image
+  docker tag $var $tag
+  docker push $tag
+  tags+=( $tag )
+done
+
+docker manifest create ghcr.io/$registry/$image:$imagetag "${tags[@]}"
+# some images have bad arch specs in the individual image manifests :(
+docker manifest annotate ghcr.io/$registry/$image:$imagetag ghcr.io/$registry/$image:$imagetag-arm64 --arch arm64
+docker manifest push --purge ghcr.io/$registry/$image:$imagetag