diff --git a/.github/workflows/docker_push.yml b/.github/workflows/docker_push.yml
new file mode 100644
index 0000000..2cf618c
--- /dev/null
+++ b/.github/workflows/docker_push.yml
@@ -0,0 +1,148 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "Build and Push Docker Images"
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+      - 'dev-*'
+    tags:
+      - '*-*.*'
+  pull_request:
+    branches:
+      - master
+      - 'dev-*'
+
+env:
+  REGISTRY: ghcr.io
+  OWNER: ${{ github.repository_owner }}
+  IMAGE_REPO: flink-docker
+
+jobs:
+  build_and_push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Flink 1.20.x
+          - flink_version: "1.20"
+            java_version: "8"
+            dockerfile: "1.20/scala_2.12-java8-ubuntu/Dockerfile"
+          - flink_version: "1.20"
+            java_version: "11"
+            dockerfile: "1.20/scala_2.12-java11-ubuntu/Dockerfile"
+          - flink_version: "1.20"
+            java_version: "17"
+            dockerfile: "1.20/scala_2.12-java17-ubuntu/Dockerfile"
+          # Flink 2.0.x
+          - flink_version: "2.0"
+            java_version: "11"
+            dockerfile: "2.0/scala_2.12-java11-ubuntu/Dockerfile"
+          - flink_version: "2.0"
+            java_version: "17"
+            dockerfile: "2.0/scala_2.12-java17-ubuntu/Dockerfile"
+          - flink_version: "2.0"
+            java_version: "21"
+            dockerfile: "2.0/scala_2.12-java21-ubuntu/Dockerfile"
+          # Flink 2.1.x (Latest)
+          - flink_version: "2.1"
+            java_version: "11"
+            dockerfile: "2.1/scala_2.12-java11-ubuntu/Dockerfile"
+          - flink_version: "2.1"
+            java_version: "17"
+            dockerfile: "2.1/scala_2.12-java17-ubuntu/Dockerfile"
+          - flink_version: "2.1"
+            java_version: "21"
+            dockerfile: "2.1/scala_2.12-java21-ubuntu/Dockerfile"
+
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine image tags
+        id: meta
+        run: |
+          FLINK_VERSION="${{ matrix.flink_version }}"
+          JAVA_VERSION="${{ matrix.java_version }}"
+
+          # Read full version from Dockerfile (e.g., 2.1.1)
+          # Extract from FLINK_TGZ_URL which contains the version
+          DOCKERFILE_PATH="${{ matrix.dockerfile }}"
+          FULL_VERSION=$(grep "FLINK_TGZ_URL=" "$DOCKERFILE_PATH" | head -1 | sed -E 's/.*flink-([0-9]+\.[0-9]+\.[0-9]+).*/\1/')
+
+          if [ -z "$FULL_VERSION" ]; then
+            echo "ERROR: Could not extract version from $DOCKERFILE_PATH"
+            exit 1
+          fi
+
+          echo "full_version=$FULL_VERSION" >> $GITHUB_OUTPUT
+
+          # Build base image name
+          BASE_TAG="${FULL_VERSION}-scala_2.12-java${JAVA_VERSION}"
+
+          # Determine tags based on event type
+          TAGS="${REGISTRY}/${OWNER}/${IMAGE_REPO}:${BASE_TAG}"
+
+          # Add branch-specific tags for branch pushes
+          if [ "${{ github.event_name }}" = "push" ] && [ "${{ github.ref_type }}" = "branch" ]; then
+            BRANCH_NAME=$(echo "${{ github.ref_name }}" | sed 's/\//-/g')
+            TAGS="${TAGS},${REGISTRY}/${OWNER}/${IMAGE_REPO}:${BRANCH_NAME}-java${JAVA_VERSION}"
+            TAGS="${TAGS},${REGISTRY}/${OWNER}/${IMAGE_REPO}:${BRANCH_NAME}-${FLINK_VERSION}-java${JAVA_VERSION}"
+          fi
+
+          # Add git sha tag
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          TAGS="${TAGS},${REGISTRY}/${OWNER}/${IMAGE_REPO}:${BASE_TAG}-${SHORT_SHA}"
+
+          echo "tags=$TAGS" >> $GITHUB_OUTPUT
+          echo "Image tags: $TAGS"
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: ${{ matrix.flink_version }}/scala_2.12-java${{ matrix.java_version }}-ubuntu
+          file: ${{ matrix.dockerfile }}
+          platforms: linux/amd64,linux/arm64/v8
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Summary
+        if: github.event_name != 'pull_request'
+        run: |
+          echo "✅ Successfully built and pushed Flink ${{ steps.meta.outputs.full_version }} with Java ${{ matrix.java_version }}"
+          echo "Tags:"
+          echo "${{ steps.meta.outputs.tags }}" | tr ',' '\n' | sed 's/^/  - /'
diff --git a/1.20/scala_2.12-java11-ubuntu/Dockerfile b/1.20/scala_2.12-java11-ubuntu/Dockerfile
index 7d42611..c34f456 100644
--- a/1.20/scala_2.12-java11-ubuntu/Dockerfile
+++ b/1.20/scala_2.12-java11-ubuntu/Dockerfile
@@ -30,8 +30,7 @@ RUN set -ex; \
   wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
   wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
   export GNUPGHOME="$(mktemp -d)"; \
-  for server in ha.pool.sks-keyservers.net $(shuf -e \
-                          hkp://p80.pool.sks-keyservers.net:80 \
+  for server in hkps://keys.openpgp.org $(shuf -e \
                           keyserver.ubuntu.com \
                           hkp://keyserver.ubuntu.com:80 \
                           pgp.mit.edu) ; do \
@@ -63,8 +62,7 @@ RUN set -ex; \
   if [ "$CHECK_GPG" = "true" ]; then \
     wget -nv -O flink.tgz.asc "$FLINK_ASC_URL"; \
     export GNUPGHOME="$(mktemp -d)"; \
-    for server in ha.pool.sks-keyservers.net $(shuf -e \
-                            hkp://p80.pool.sks-keyservers.net:80 \
+    for server in hkps://keys.openpgp.org $(shuf -e \
                             keyserver.ubuntu.com \
                             hkp://keyserver.ubuntu.com:80 \
                             pgp.mit.edu) ; do \
diff --git a/1.20/scala_2.12-java17-ubuntu/Dockerfile b/1.20/scala_2.12-java17-ubuntu/Dockerfile
index f14bf3f..48f479d 100644
--- a/1.20/scala_2.12-java17-ubuntu/Dockerfile
+++ b/1.20/scala_2.12-java17-ubuntu/Dockerfile
@@ -30,8 +30,7 @@ RUN set -ex; \
   wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
   wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
   export GNUPGHOME="$(mktemp -d)"; \
-  for server in ha.pool.sks-keyservers.net $(shuf -e \
-                          hkp://p80.pool.sks-keyservers.net:80 \
+  for server in hkps://keys.openpgp.org $(shuf -e \
                           keyserver.ubuntu.com \
                           hkp://keyserver.ubuntu.com:80 \
                           pgp.mit.edu) ; do \
@@ -63,8 +62,7 @@ RUN set -ex; \
   if [ "$CHECK_GPG" = "true" ]; then \
     wget -nv -O flink.tgz.asc "$FLINK_ASC_URL"; \
     export GNUPGHOME="$(mktemp -d)"; \
-    for server in ha.pool.sks-keyservers.net $(shuf -e \
-                            hkp://p80.pool.sks-keyservers.net:80 \
+    for server in hkps://keys.openpgp.org $(shuf -e \
                             keyserver.ubuntu.com \
                             hkp://keyserver.ubuntu.com:80 \
                             pgp.mit.edu) ; do \
diff --git a/1.20/scala_2.12-java8-ubuntu/Dockerfile b/1.20/scala_2.12-java8-ubuntu/Dockerfile
index b93c6d5..e56083b 100644
--- a/1.20/scala_2.12-java8-ubuntu/Dockerfile
+++ b/1.20/scala_2.12-java8-ubuntu/Dockerfile
@@ -30,8 +30,7 @@ RUN set -ex; \
   wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
   wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
   export GNUPGHOME="$(mktemp -d)"; \
-  for server in ha.pool.sks-keyservers.net $(shuf -e \
-                          hkp://p80.pool.sks-keyservers.net:80 \
+  for server in hkps://keys.openpgp.org $(shuf -e \
                           keyserver.ubuntu.com \
                           hkp://keyserver.ubuntu.com:80 \
                           pgp.mit.edu) ; do \
@@ -63,8 +62,7 @@ RUN set -ex; \
   if [ "$CHECK_GPG" = "true" ]; then \
     wget -nv -O flink.tgz.asc "$FLINK_ASC_URL"; \
     export GNUPGHOME="$(mktemp -d)"; \
-    for server in ha.pool.sks-keyservers.net $(shuf -e \
-                            hkp://p80.pool.sks-keyservers.net:80 \
+    for server in hkps://keys.openpgp.org $(shuf -e \
                             keyserver.ubuntu.com \
                             hkp://keyserver.ubuntu.com:80 \
                             pgp.mit.edu) ; do \
diff --git a/2.0/scala_2.12-java11-ubuntu/Dockerfile b/2.0/scala_2.12-java11-ubuntu/Dockerfile
index d2be5b6..52c4f2b 100644
--- a/2.0/scala_2.12-java11-ubuntu/Dockerfile
+++ b/2.0/scala_2.12-java11-ubuntu/Dockerfile
@@ -30,8 +30,7 @@ RUN set -ex; \
   wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
   wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
   export GNUPGHOME="$(mktemp -d)"; \
-  for server in ha.pool.sks-keyservers.net $(shuf -e \
-                          hkp://p80.pool.sks-keyservers.net:80 \
+  for server in hkps://keys.openpgp.org $(shuf -e \
                           keyserver.ubuntu.com \
                           hkp://keyserver.ubuntu.com:80 \
                           pgp.mit.edu) ; do \
@@ -63,8 +62,7 @@ RUN set -ex; \
   if [ "$CHECK_GPG" = "true" ]; then \
     wget -nv -O flink.tgz.asc "$FLINK_ASC_URL"; \
     export GNUPGHOME="$(mktemp -d)"; \
-    for server in ha.pool.sks-keyservers.net $(shuf -e \
-                            hkp://p80.pool.sks-keyservers.net:80 \
+    for server in hkps://keys.openpgp.org $(shuf -e \
                             keyserver.ubuntu.com \
                             hkp://keyserver.ubuntu.com:80 \
                             pgp.mit.edu) ; do \
diff --git a/2.0/scala_2.12-java17-ubuntu/Dockerfile b/2.0/scala_2.12-java17-ubuntu/Dockerfile
index aba51d5..db1918d 100644
--- a/2.0/scala_2.12-java17-ubuntu/Dockerfile
+++ b/2.0/scala_2.12-java17-ubuntu/Dockerfile
@@ -30,8 +30,7 @@ RUN set -ex; \
   wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
   wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
   export GNUPGHOME="$(mktemp -d)"; \
-  for server in ha.pool.sks-keyservers.net $(shuf -e \
-                          hkp://p80.pool.sks-keyservers.net:80 \
+  for server in hkps://keys.openpgp.org $(shuf -e \
                           keyserver.ubuntu.com \
                           hkp://keyserver.ubuntu.com:80 \
                           pgp.mit.edu) ; do \
@@ -63,8 +62,7 @@ RUN set -ex; \
   if [ "$CHECK_GPG" = "true" ]; then \
     wget -nv -O flink.tgz.asc "$FLINK_ASC_URL"; \
     export GNUPGHOME="$(mktemp -d)"; \
-    for server in ha.pool.sks-keyservers.net $(shuf -e \
-                            hkp://p80.pool.sks-keyservers.net:80 \
+    for server in hkps://keys.openpgp.org $(shuf -e \
                             keyserver.ubuntu.com \
                             hkp://keyserver.ubuntu.com:80 \
                             pgp.mit.edu) ; do \
diff --git a/2.0/scala_2.12-java21-ubuntu/Dockerfile b/2.0/scala_2.12-java21-ubuntu/Dockerfile
index f3d9075..638ec3e 100644
--- a/2.0/scala_2.12-java21-ubuntu/Dockerfile
+++ b/2.0/scala_2.12-java21-ubuntu/Dockerfile
@@ -30,8 +30,7 @@ RUN set -ex; \
   wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
   wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
   export GNUPGHOME="$(mktemp -d)"; \
-  for server in ha.pool.sks-keyservers.net $(shuf -e \
-                          hkp://p80.pool.sks-keyservers.net:80 \
+  for server in hkps://keys.openpgp.org $(shuf -e \
                           keyserver.ubuntu.com \
                           hkp://keyserver.ubuntu.com:80 \
                           pgp.mit.edu) ; do \
@@ -63,8 +62,7 @@ RUN set -ex; \
   if [ "$CHECK_GPG" = "true" ]; then \
     wget -nv -O flink.tgz.asc "$FLINK_ASC_URL"; \
     export GNUPGHOME="$(mktemp -d)"; \
-    for server in ha.pool.sks-keyservers.net $(shuf -e \
-                            hkp://p80.pool.sks-keyservers.net:80 \
+    for server in hkps://keys.openpgp.org $(shuf -e \
                             keyserver.ubuntu.com \
                             hkp://keyserver.ubuntu.com:80 \
                             pgp.mit.edu) ; do \
diff --git a/2.1/scala_2.12-java11-ubuntu/Dockerfile b/2.1/scala_2.12-java11-ubuntu/Dockerfile
index ec1ee74..799f2b4 100644
--- a/2.1/scala_2.12-java11-ubuntu/Dockerfile
+++ b/2.1/scala_2.12-java11-ubuntu/Dockerfile
@@ -30,8 +30,7 @@ RUN set -ex; \
   wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
   wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
   export GNUPGHOME="$(mktemp -d)"; \
-  for server in ha.pool.sks-keyservers.net $(shuf -e \
-                          hkp://p80.pool.sks-keyservers.net:80 \
+  for server in hkps://keys.openpgp.org $(shuf -e \
                           keyserver.ubuntu.com \
                           hkp://keyserver.ubuntu.com:80 \
                           pgp.mit.edu) ; do \
@@ -63,8 +62,7 @@ RUN set -ex; \
   if [ "$CHECK_GPG" = "true" ]; then \
     wget -nv -O flink.tgz.asc "$FLINK_ASC_URL"; \
     export GNUPGHOME="$(mktemp -d)"; \
-    for server in ha.pool.sks-keyservers.net $(shuf -e \
-                            hkp://p80.pool.sks-keyservers.net:80 \
+    for server in hkps://keys.openpgp.org $(shuf -e \
                             keyserver.ubuntu.com \
                             hkp://keyserver.ubuntu.com:80 \
                             pgp.mit.edu) ; do \
diff --git a/2.1/scala_2.12-java17-ubuntu/Dockerfile b/2.1/scala_2.12-java17-ubuntu/Dockerfile
index b341586..7822647 100644
--- a/2.1/scala_2.12-java17-ubuntu/Dockerfile
+++ b/2.1/scala_2.12-java17-ubuntu/Dockerfile
@@ -30,8 +30,7 @@ RUN set -ex; \
   wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
   wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
   export GNUPGHOME="$(mktemp -d)"; \
-  for server in ha.pool.sks-keyservers.net $(shuf -e \
-                          hkp://p80.pool.sks-keyservers.net:80 \
+  for server in hkps://keys.openpgp.org $(shuf -e \
                           keyserver.ubuntu.com \
                           hkp://keyserver.ubuntu.com:80 \
                           pgp.mit.edu) ; do \
@@ -63,8 +62,7 @@ RUN set -ex; \
   if [ "$CHECK_GPG" = "true" ]; then \
     wget -nv -O flink.tgz.asc "$FLINK_ASC_URL"; \
     export GNUPGHOME="$(mktemp -d)"; \
-    for server in ha.pool.sks-keyservers.net $(shuf -e \
-                            hkp://p80.pool.sks-keyservers.net:80 \
+    for server in hkps://keys.openpgp.org $(shuf -e \
                             keyserver.ubuntu.com \
                             hkp://keyserver.ubuntu.com:80 \
                             pgp.mit.edu) ; do \
diff --git a/2.1/scala_2.12-java21-ubuntu/Dockerfile b/2.1/scala_2.12-java21-ubuntu/Dockerfile
index 7e53e5d..172619e 100644
--- a/2.1/scala_2.12-java21-ubuntu/Dockerfile
+++ b/2.1/scala_2.12-java21-ubuntu/Dockerfile
@@ -30,8 +30,7 @@ RUN set -ex; \
   wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
   wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
   export GNUPGHOME="$(mktemp -d)"; \
-  for server in ha.pool.sks-keyservers.net $(shuf -e \
-                          hkp://p80.pool.sks-keyservers.net:80 \
+  for server in hkps://keys.openpgp.org $(shuf -e \
                           keyserver.ubuntu.com \
                           hkp://keyserver.ubuntu.com:80 \
                           pgp.mit.edu) ; do \
@@ -63,8 +62,7 @@ RUN set -ex; \
   if [ "$CHECK_GPG" = "true" ]; then \
     wget -nv -O flink.tgz.asc "$FLINK_ASC_URL"; \
     export GNUPGHOME="$(mktemp -d)"; \
-    for server in ha.pool.sks-keyservers.net $(shuf -e \
-                            hkp://p80.pool.sks-keyservers.net:80 \
+    for server in hkps://keys.openpgp.org $(shuf -e \
                             keyserver.ubuntu.com \
                             hkp://keyserver.ubuntu.com:80 \
                             pgp.mit.edu) ; do \
diff --git a/publish-to-dockerhub.sh b/publish-to-dockerhub.sh
index 6a73fed..944753c 100755
--- a/publish-to-dockerhub.sh
+++ b/publish-to-dockerhub.sh
@@ -17,45 +17,180 @@
 # limitations under the License.
 #
 
-# This script publishes the Flink docker images to any Docker registry. By default it's configured to the apache/flink DockerHub account.
+# This script copies Flink docker images from GHCR to Docker Hub.
+# It uses crane to efficiently copy images without pulling them locally.
+#
+# Prerequisites:
+#   - crane installed (https://github.com/google/go-containerregistry/blob/main/cmd/crane/doc/crane.md)
+#   - Authentication to Docker Hub (docker login)
+#
+# Usage:
+#   ./publish-to-dockerhub.sh [--dry-run]
+#   SOURCE_REGISTRY=ghcr.io/myorg/flink-docker TARGET_REGISTRY=myorg/flink ./publish-to-dockerhub.sh
+#   ./publish-to-dockerhub.sh --dry-run  # Test without actually copying
+
+set -euo pipefail
+
+# Parse command line arguments
+DRY_RUN=false
+for arg in "$@"; do
+    case $arg in
+        --dry-run|-n)
+            DRY_RUN=true
+            shift
+            ;;
+        --help|-h)
+            echo "Usage: $0 [--dry-run]"
+            echo ""
+            echo "Options:"
+            echo "  --dry-run, -n    Show what would be copied without actually copying"
+            echo "  --help, -h       Show this help message"
+            echo ""
+            echo "Environment variables:"
+            echo "  SOURCE_REGISTRY  Source registry (default: ghcr.io/apache/flink-docker)"
+            echo "  TARGET_REGISTRY  Target registry (default: apache/flink)"
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $arg"
+            echo "Use --help for usage information"
+            exit 1
+            ;;
+    esac
+done
 
 self="$(basename "$BASH_SOURCE")"
 cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
 
 source common.sh
 
+# Configuration
+SOURCE_REGISTRY=${SOURCE_REGISTRY:-"ghcr.io/apache/flink-docker"}
 TARGET_REGISTRY=${TARGET_REGISTRY:-"apache/flink"}
 
-echo "Publishing to target registry: $TARGET_REGISTRY"
+echo "============================================"
+echo "Publishing Flink Docker Images"
+if [ "$DRY_RUN" = true ]; then
+    echo "🔍 DRY RUN MODE - No images will be copied"
+fi
+echo "============================================"
+echo "Source: $SOURCE_REGISTRY"
+echo "Target: $TARGET_REGISTRY"
+echo "============================================"
+echo ""
+
+# Confirmation check
+if [ "$DRY_RUN" = false ]; then
+    echo "⚠️  IMPORTANT: Before running this script, ensure that:"
+    echo ""
+    echo "1. The GitHub Actions workflow 'Build and Push Docker Images' has"
+    echo "   completed successfully for the release you want to publish"
+    echo ""
+    echo "2. All Docker images are available in GHCR at:"
+    echo "   https://github.com/orgs/apache/packages?repo_name=flink-docker"
+    echo "   (or https://github.com/users/${USER}/packages if using a fork)"
+    echo ""
+    echo "3. The images were built from the correct branch/tag"
+    echo "   - For releases: master branch"
+    echo "   - For testing: dev-* branches"
+    echo ""
+    echo "4. You are authenticated to Docker Hub:"
+    echo "   docker login"
+    echo ""
+    read -p "Have you verified the above? (yes/no): " -r
+    echo ""
+    if [[ ! $REPLY =~ ^[Yy][Ee][Ss]$ ]]; then
+        echo "❌ Aborted. Please verify the build workflow completed successfully first."
+        exit 1
+    fi
+
+    echo "✅ Proceeding with image publication..."
+    echo ""
+else
+    echo "🔍 Dry-run mode: Will verify images exist and show what would be copied"
+    echo ""
+fi
+
+# Check if crane is installed
+if ! command -v crane &> /dev/null; then
+    echo "ERROR: crane is not installed"
+    echo "Please install crane from: https://github.com/google/go-containerregistry/blob/main/cmd/crane/doc/crane.md"
+    echo ""
+    echo "Quick install:"
+    echo "  macOS:   brew install crane"
+    echo "  Linux:   go install github.com/google/go-containerregistry/cmd/crane@latest"
+    exit 1
+fi
+
+# Process each Dockerfile
+for dockerfile in $(find . -name "Dockerfile" | sort); do
+    dir=$(dirname "$dockerfile")
 
-for dockerfile in $(find . -name "Dockerfile"); do
-    dir=$(dirname $dockerfile)
+    # Extract version and java version from Dockerfile
+    FLINK_VERSION=$(grep "FLINK_TGZ_URL=" "$dockerfile" | head -1 | sed -E 's/.*flink-([0-9]+\.[0-9]+\.[0-9]+).*/\1/')
 
+    # Extract java version from directory name (e.g., scala_2.12-java11-ubuntu -> java11)
+    JAVA_VERSION=$(basename "$dir" | sed -E 's/.*-java([0-9]+)-.*/\1/')
+
+    if [ -z "$FLINK_VERSION" ] || [ -z "$JAVA_VERSION" ]; then
+        echo "⚠️  Skipping $dir - could not extract version info"
+        continue
+    fi
+
+    # Construct source image tag
+    SOURCE_TAG="${FLINK_VERSION}-scala_2.12-java${JAVA_VERSION}"
+    SOURCE_IMAGE="${SOURCE_REGISTRY}:${SOURCE_TAG}"
+
+    # Read target tags from metadata
     metadata="$dir/release.metadata"
-    tags=$(extractValue "Tags" $metadata)
-    tags=$(pruneTags "$tags" $latest_version)
+    if [ ! -f "$metadata" ]; then
+        echo "⚠️  Skipping $dir - no metadata file found"
+        continue
+    fi
+
+    tags=$(extractValue "Tags" "$metadata")
+    tags=$(pruneTags "$tags" "$latest_version")
 
-    echo "Building image in $dir"
+    echo "📦 Processing Flink ${FLINK_VERSION} Java ${JAVA_VERSION}"
+    echo "   Source: ${SOURCE_IMAGE}"
 
-    DOCKER_BUILD_CMD="docker build"
-    DOCKER_PUSH_CMDS=()
+    # Check if source image exists
+    if ! crane manifest "$SOURCE_IMAGE" &> /dev/null; then
+        echo "   ❌ ERROR: Source image not found in GHCR"
+        echo "   Please ensure the image was built and pushed by the CI workflow"
+        echo ""
+        echo "Aborting: Cannot proceed with missing images"
+        exit 1
+    fi
+
+    # Copy to each target tag
     IFS=',' read -ra TAGS_ARRAY <<< "$tags"
-	for raw_tag in "${TAGS_ARRAY[@]}"; do
-		# trim whitespace
-		tag=`echo $raw_tag | xargs`
-	    DOCKER_BUILD_CMD+=" -t $TARGET_REGISTRY:$tag"
-	    DOCKER_PUSH_CMDS+=( "docker push $TARGET_REGISTRY:$tag")
-	done
-	DOCKER_BUILD_CMD+=" $dir"
-	echo -e "\tBuilding docker image using command"
-	echo -e "\t\t$DOCKER_BUILD_CMD"
-	eval $DOCKER_BUILD_CMD
-	echo -e "\tPushing tags"
-	for push_cmd in "${DOCKER_PUSH_CMDS[@]}"; do
-		echo -e "\t\tPushing using $push_cmd"
-		eval $push_cmd
-	done
-
-	#newline
-	echo
+    for raw_tag in "${TAGS_ARRAY[@]}"; do
+        # Trim whitespace
+        tag=$(echo "$raw_tag" | xargs)
+        TARGET_IMAGE="${TARGET_REGISTRY}:${tag}"
+
+        if [ "$DRY_RUN" = true ]; then
+            echo "   🔍 Would copy to ${TARGET_IMAGE}"
+        else
+            echo "   📤 Copying to ${TARGET_IMAGE}"
+            if crane copy "$SOURCE_IMAGE" "$TARGET_IMAGE"; then
+                echo "      ✅ Success"
+            else
+                echo "      ❌ Failed"
+                exit 1
+            fi
+        fi
+    done
+
+    echo ""
 done
+
+echo "============================================"
+if [ "$DRY_RUN" = true ]; then
+    echo "🔍 Dry-run completed successfully!"
+    echo "Run without --dry-run to actually copy images."
+else
+    echo "✅ All images published successfully!"
+fi
+echo "============================================"