diff --git a/overlays/tb-dev/kustomization.yaml b/overlays/tb-dev/kustomization.yaml
index c5177f4..a5b5570 100644
--- a/overlays/tb-dev/kustomization.yaml
+++ b/overlays/tb-dev/kustomization.yaml
@@ -11,9 +11,17 @@ resources:
 - accounts/flower-ingress.yaml
 - accounts/securitygrouppolicy.yaml
 images:
+# Multi-arch (amd64 + arm64) accounts image, now published to GHCR by
+# thunderbird-accounts (publish-images.yml). The Pro EKS clusters are Graviton
+# (arm64); the ECR image the deploy-stage pipeline builds is amd64-only, so EKS
+# pulls the multi-arch manifest from GHCR instead.
+# TODO before merge: pin to a specific published digest, e.g.
+#   newName: ghcr.io/thunderbird/thunderbird-accounts
+#   digest: sha256:<published-digest>
+# `latest` is an interim placeholder for this draft.
 - name: REPLACE_ACCOUNTS_ECR/accounts
-  newName: 718959508124.dkr.ecr.eu-central-1.amazonaws.com/accounts
-  digest: sha256:475f5999277a4242a4beb704455847fe0b0fa8a61c390fcc00adb1eca80efbd5
+  newName: ghcr.io/thunderbird/thunderbird-accounts
+  newTag: latest
 patches:
 # Env-specific, non-secret config (hosts, URLs, public base URL).
 - path: accounts/configmap.yaml
diff --git a/overlays/tb-prod/kustomization.yaml b/overlays/tb-prod/kustomization.yaml
index 1941d61..aec9c77 100644
--- a/overlays/tb-prod/kustomization.yaml
+++ b/overlays/tb-prod/kustomization.yaml
@@ -11,11 +11,16 @@ resources:
   - accounts/securitygrouppolicy.yaml
 
 images:
-  # Set to the multi-arch accounts image (arm64) once available to tb-prod
-  # (per-account ECR mirror or cross-account pull) -- thunderbird/platform-infrastructure#593.
+  # Multi-arch (amd64 + arm64) accounts image, now published to GHCR by
+  # thunderbird-accounts (publish-images.yml) -- this resolves the arm64
+  # availability gap from thunderbird/platform-infrastructure#593 (the Pro EKS
+  # clusters are Graviton/arm64; the deploy-stage ECR image is amd64-only).
+  # TODO before merge: pin to a specific published :<sha> (or use `digest:`), e.g.
+  #   digest: sha256:<published-digest>
+  # `latest` is an interim placeholder for this draft.
   - name: REPLACE_ACCOUNTS_ECR/accounts
-    newName: 689951664252.dkr.ecr.eu-central-1.amazonaws.com/accounts
-    newTag: 17f1e8ed1765d572dd91f03ed12dc326df60830c
+    newName: ghcr.io/thunderbird/thunderbird-accounts
+    newTag: latest
 
 patches:
   # Env-specific, non-secret config (hosts, URLs, public base URL).