diff --git a/.github/workflows/publish-helm.yaml b/.github/workflows/publish-helm.yaml
index efa5ae1..2357a29 100644
--- a/.github/workflows/publish-helm.yaml
+++ b/.github/workflows/publish-helm.yaml
@@ -95,8 +95,16 @@ jobs:
             echo "VERSION=0.0.0-${{ github.sha }}" >> $GITHUB_ENV
           else
             echo "PUBLISH_MODE=release" >> $GITHUB_ENV
-            echo "HUB=registry-1.docker.io/apache" >> $GITHUB_ENV
-            echo "DOCKER_REGISTRY=registry-1.docker.io" >> $GITHUB_ENV
+            # docker.io, never registry-1.docker.io, matching apache/skywalking's publish-docker.
+            #
+            # This is what broke the 5.0.0 publish. `docker login <host>` stores the credential
+            # under the host you name, and `helm push` then normalises back to Docker Hub's
+            # canonical host and looks there, finding nothing. Both hostnames PULL anonymously
+            # without complaint -- the chart's own dependency resolves through either -- so the
+            # mismatch stays invisible until a push with credentials, the one operation nothing
+            # had ever exercised.
+            echo "HUB=docker.io/apache" >> $GITHUB_ENV
+            echo "DOCKER_REGISTRY=docker.io" >> $GITHUB_ENV
             echo "DOCKER_USERNAME=${{ secrets.DOCKERHUB_USER }}" >> $GITHUB_ENV
             echo "DOCKER_PASSWORD=${{ secrets.DOCKERHUB_TOKEN }}" >> $GITHUB_ENV
             echo "VERSION=${VERSION}" >> $GITHUB_ENV
diff --git a/Makefile b/Makefile
index 699cd89..a5a7159 100644
--- a/Makefile
+++ b/Makefile
@@ -71,4 +71,4 @@ release: release-src package
 	shasum -a 512 $(CHART_NAME)-$(VERSION).tgz > $(CHART_NAME)-$(VERSION).tgz.sha512
 
 publish: package
-	helm push ${CHART_NAME}-${VERSION}.tgz oci://registry-1.docker.io/apache
+	helm push ${CHART_NAME}-${VERSION}.tgz oci://docker.io/apache
diff --git a/README.md b/README.md
index 30cd897..1011c2b 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,7 @@ Set them on the command line, or put them in a values file and pass `-f my-value
 # Install
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --create-namespace \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
diff --git a/chart/skywalking/Chart.yaml b/chart/skywalking/Chart.yaml
index 4f02da7..3558bac 100644
--- a/chart/skywalking/Chart.yaml
+++ b/chart/skywalking/Chart.yaml
@@ -46,5 +46,5 @@ dependencies:
 - name: skywalking-banyandb-helm
   alias: banyandb
   version: 0.7.0
-  repository: oci://registry-1.docker.io/apache
+  repository: oci://docker.io/apache
   condition: banyandb.enabled
diff --git a/chart/skywalking/README.md b/chart/skywalking/README.md
index 4462e02..07de158 100644
--- a/chart/skywalking/README.md
+++ b/chart/skywalking/README.md
@@ -33,7 +33,7 @@ independently.
 (`banyandb.enabled=true`).
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --create-namespace \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
diff --git a/docs/README.md b/docs/README.md
index a8925ce..c20e96a 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -11,7 +11,7 @@ CRDs and its image are developed and released.
 ## Start here
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --create-namespace \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
diff --git a/docs/contributing/release.md b/docs/contributing/release.md
index c14e79d..ec8d35d 100644
--- a/docs/contributing/release.md
+++ b/docs/contributing/release.md
@@ -23,7 +23,7 @@ carries six files.
 | --- | --- | --- |
 | dist.apache.org | source tarball, `.asc`, `.sha512` | `skywalking-helm-5.0.0-src.tgz` |
 | dist.apache.org | packaged chart, `.asc`, `.sha512` | `skywalking-helm-5.0.0.tgz` |
-| Docker Hub (OCI) | the chart users install — a convenience binary, pushed **after** the vote | `oci://registry-1.docker.io/apache/skywalking-helm:5.0.0` |
+| Docker Hub (OCI) | the chart users install — a convenience binary, pushed **after** the vote | `oci://docker.io/apache/skywalking-helm:5.0.0` |
 | ghcr.io (OCI) | `0.0.0-<sha>` snapshot of every `master` commit — **not** a release | `oci://ghcr.io/apache/skywalking-helm/skywalking-helm:0.0.0-<sha>` |
 
 The dist path for this project is `skywalking/helm/`. The `skywalking/kubernetes/` directory on dist
@@ -95,7 +95,7 @@ Every dependency version has to resolve before you can build. BanyanDB Helm is r
 to the same Docker Hub OCI namespace, so ask the registry:
 
 ```shell
-helm show chart oci://registry-1.docker.io/apache/skywalking-banyandb-helm --version 0.7.0
+helm show chart oci://docker.io/apache/skywalking-banyandb-helm --version 0.7.0
 ```
 
 An `Error: ... not found` means it is not published there. Cross-check the source release exists too:
@@ -454,7 +454,7 @@ Before it pushes anything the workflow runs three hard guards, under a repositor
 
 It packages with `make package` (not bare `helm package`, so `NOTICE` and `LICENSE` are in the
 chart), re-checks that both files are inside the tarball, and pushes to
-`oci://registry-1.docker.io/apache`, where `helm push` appends the chart name — landing at
+`oci://docker.io/apache`, where `helm push` appends the chart name — landing at
 `apache/skywalking-helm:$VERSION`.
 
 Watch it and verify the result — this is not ceremony. Docker Hub currently holds
@@ -463,7 +463,7 @@ the registry**, which is the gap this workflow exists to close. Confirm yours la
 
 ```shell
 gh run list --workflow publish-helm.yaml --repo apache/skywalking-helm --limit 3
-helm show chart oci://registry-1.docker.io/apache/skywalking-helm --version "$VERSION"
+helm show chart oci://docker.io/apache/skywalking-helm --version "$VERSION"
 ```
 
 A `FetchReference ... not found` means the chart is not there, whatever the workflow's exit status
@@ -497,7 +497,7 @@ It prints this list at the end; the detail is here.
 
 ```makefile
 publish: package
-	helm push ${CHART_NAME}-${VERSION}.tgz oci://registry-1.docker.io/apache
+	helm push ${CHART_NAME}-${VERSION}.tgz oci://docker.io/apache
 ```
 
 It re-packages from your **working tree** and pushes to Docker Hub. Reach for it only when Actions is
@@ -511,10 +511,10 @@ It has **none** of the workflow's guards:
 - It builds from your working copy, not from the tag — uncommitted local edits get published, and
   nothing ties the pushed chart to the voted artifact.
 
-If you must use it: `helm registry login registry-1.docker.io` first (write access to the `apache`
+If you must use it: `helm registry login docker.io` first (write access to the `apache`
 Docker Hub organization is required), run it from a pristine checkout of `v$VERSION`, and only after
 the vote has passed and the artifacts have moved to `dist/release`. Verify with
-`helm show chart oci://registry-1.docker.io/apache/skywalking-helm --version $VERSION`.
+`helm show chart oci://docker.io/apache/skywalking-helm --version $VERSION`.
 
 ---
 
diff --git a/docs/evaluate/requirements.md b/docs/evaluate/requirements.md
index bfe4f86..323707b 100644
--- a/docs/evaluate/requirements.md
+++ b/docs/evaluate/requirements.md
@@ -8,7 +8,7 @@ default (Elasticsearch) path requires.
 | Requirement | Version | Where it comes from |
 |---|---|---|
 | Kubernetes | 1.21+ | `eck-operator` 3.3.1 and `eck-elasticsearch` 0.18.1 both declare a `kubeVersion` floor of `1.21.0-0`; `chart/skywalking` itself declares none. Helm does **not** enforce a *subchart's* `kubeVersion`, so an older cluster still installs — it just runs an unsupported ECK. |
-| Helm | 3.8+ (4.x also works) | The chart is `apiVersion: v2`, and `helm dep up` pulls the BanyanDB dependency from an OCI registry (`oci://registry-1.docker.io/apache`), which needs Helm's non-experimental OCI support (3.8.0). |
+| Helm | 3.8+ (4.x also works) | The chart is `apiVersion: v2`, and `helm dep up` pulls the BanyanDB dependency from an OCI registry (`oci://docker.io/apache`), which needs Helm's non-experimental OCI support (3.8.0). |
 | `kubectl` | matching your cluster | Used to watch the install (`kubectl get pods -w`) and for all troubleshooting. |
 
 CI exercises the chart on a four-node [kind](https://kind.sigs.k8s.io/) cluster running
diff --git a/docs/evaluate/version-compatibility.md b/docs/evaluate/version-compatibility.md
index e59b3a5..123a5e6 100644
--- a/docs/evaluate/version-compatibility.md
+++ b/docs/evaluate/version-compatibility.md
@@ -19,7 +19,7 @@ This is the combination every cell in `test/e2e/` installs on each CI run, so it
 | Kubernetes | `v1.28.15` — every e2e cell runs `test/e2e/kind28.yaml` (`kindest/node:v1.28.15`) | your cluster |
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
diff --git a/docs/evaluate/what-this-chart-deploys.md b/docs/evaluate/what-this-chart-deploys.md
index 4370bc9..4b98b94 100644
--- a/docs/evaluate/what-this-chart-deploys.md
+++ b/docs/evaluate/what-this-chart-deploys.md
@@ -13,7 +13,7 @@ Three values have no defaults and must be supplied every time: `oap.image.tag`,
 `oap.storageType`, `ui.image.tag`.
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --create-namespace \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=elasticsearch \
@@ -107,7 +107,7 @@ or `metrics` entries and they are opened on both the container and the Service.
 A gateway that fronts OAP for agent traffic. Off by default; it needs its own image tag.
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=elasticsearch \
diff --git a/docs/expose/oap-endpoints.md b/docs/expose/oap-endpoints.md
index bf16c79..a5697ba 100644
--- a/docs/expose/oap-endpoints.md
+++ b/docs/expose/oap-endpoints.md
@@ -54,7 +54,7 @@ helm template skywalking chart/skywalking \
 Uncomment the lines already present in `values.yaml`, or pass them on the command line:
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
diff --git a/docs/expose/tls.md b/docs/expose/tls.md
index ca53d89..7d93c93 100644
--- a/docs/expose/tls.md
+++ b/docs/expose/tls.md
@@ -224,7 +224,7 @@ ui:
 
 ```shell
 helm upgrade --install "${SKYWALKING_RELEASE_NAME}" \
-  oci://registry-1.docker.io/apache/skywalking-helm \
+  oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   -n "${SKYWALKING_RELEASE_NAMESPACE}" \
   --set oap.image.tag=11.0.0 \
diff --git a/docs/install/chart-sources.md b/docs/install/chart-sources.md
index d74582b..ed25310 100644
--- a/docs/install/chart-sources.md
+++ b/docs/install/chart-sources.md
@@ -7,7 +7,7 @@ address to point `helm install` at, and what each one actually carries.
 
 | Source | Address | Carries | Use when |
 | --- | --- | --- | --- |
-| Docker Hub (OCI) | `oci://registry-1.docker.io/apache/skywalking-helm` | Released `skywalking-helm` charts, `4.3.0` through `4.8.0` | Default. Any normal install. |
+| Docker Hub (OCI) | `oci://docker.io/apache/skywalking-helm` | Released `skywalking-helm` charts, `4.3.0` through `4.8.0` | Default. Any normal install. |
 | Apache JFrog (legacy) | `https://apache.jfrog.io/artifactory/skywalking-helm` | Released charts `4.3.0` and older only — frozen, no new releases | You are pinned to an old chart and cannot move yet. |
 | ghcr.io (OCI) | `oci://ghcr.io/apache/skywalking-helm/skywalking-helm` | Snapshot of every commit on `master`, versioned `0.0.0-<commit-sha>` | Testing an unreleased fix. |
 | Source tree | `git clone` + `helm dep up chart/skywalking` | Your working copy of `chart/skywalking` | You are editing the chart. |
@@ -24,7 +24,7 @@ required values are always yours to set:
 ## Released chart, Docker Hub OCI registry (>= 4.3.0)
 
 The chart is pushed to Docker Hub as an OCI artifact (`make publish` runs
-`helm push … oci://registry-1.docker.io/apache`). There is no `helm repo add` step — an OCI
+`helm push … oci://docker.io/apache`). There is no `helm repo add` step — an OCI
 reference is the chart.
 
 ```shell
@@ -33,7 +33,7 @@ export SKYWALKING_RELEASE_NAME=skywalking
 export SKYWALKING_RELEASE_NAMESPACE=default
 
 helm install "${SKYWALKING_RELEASE_NAME}" \
-  oci://registry-1.docker.io/apache/skywalking-helm \
+  oci://docker.io/apache/skywalking-helm \
   --version "${SKYWALKING_RELEASE_VERSION}" \
   -n "${SKYWALKING_RELEASE_NAMESPACE}" \
   --set oap.image.tag=11.0.0 \
@@ -47,8 +47,8 @@ available chart versions — pick and pin `--version` deliberately. To inspect o
 before installing:
 
 ```shell
-helm show values oci://registry-1.docker.io/apache/skywalking-helm --version 5.0.0
-helm pull oci://registry-1.docker.io/apache/skywalking-helm --version 5.0.0
+helm show values oci://docker.io/apache/skywalking-helm --version 5.0.0
+helm pull oci://docker.io/apache/skywalking-helm --version 5.0.0
 ```
 
 The registry holds `4.3.0`, `4.4.0`, `4.5.0`, `4.6.0`, `4.7.0` and `4.8.0`. `4.9.0` is a released
@@ -128,7 +128,7 @@ versions — the BanyanDB server version is `banyandb.image.tag`, currently `0.1
 | `eck-operator` | 3.3.1 | `https://helm.elastic.co/` | `elasticsearch.enabled` |
 | `eck-elasticsearch` (alias `elasticsearch`) | 0.18.1 | `https://helm.elastic.co/` | `elasticsearch.enabled` |
 | `postgresql` | 12.1.2 | `https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami` | `postgresql.enabled` |
-| `skywalking-banyandb-helm` (alias `banyandb`) | 0.7.0 | `oci://registry-1.docker.io/apache` | `banyandb.enabled` |
+| `skywalking-banyandb-helm` (alias `banyandb`) | 0.7.0 | `oci://docker.io/apache` | `banyandb.enabled` |
 
 `make package` does the same `helm dep up` plus `helm package`, with `LICENSE` and `NOTICE` copied
 into the chart directory first, and drops `skywalking-helm-5.0.0.tgz` in the repo root. `make clean`
diff --git a/docs/install/quick-start.md b/docs/install/quick-start.md
index 166b079..1456eed 100644
--- a/docs/install/quick-start.md
+++ b/docs/install/quick-start.md
@@ -43,7 +43,7 @@ not both own the CRDs.
 
 ```shell
 helm install "${SKYWALKING_RELEASE_NAME}" \
-  oci://registry-1.docker.io/apache/skywalking-helm \
+  oci://docker.io/apache/skywalking-helm \
   --version "${SKYWALKING_RELEASE_VERSION}" \
   -n "${SKYWALKING_RELEASE_NAMESPACE}" --create-namespace \
   --set oap.image.tag=11.0.0 \
diff --git a/docs/operate/oap-init-job.md b/docs/operate/oap-init-job.md
index 7dd6a12..3e24019 100644
--- a/docs/operate/oap-init-job.md
+++ b/docs/operate/oap-init-job.md
@@ -42,7 +42,7 @@ To have Helm surface init-Job failures directly — instead of only reporting th
 Ready — add `--wait-for-jobs` alongside `--wait`:
 
 ```shell
-helm upgrade --install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm upgrade --install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --create-namespace \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
@@ -181,7 +181,7 @@ value, delete the Job and upgrade — Helm recreates the now-missing resource:
 
 ```shell
 kubectl delete job -n skywalking -l release=skywalking
-helm upgrade skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm upgrade skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --reuse-values
 ```
 
diff --git a/docs/operate/satellite.md b/docs/operate/satellite.md
index b24bd5d..2b824df 100644
--- a/docs/operate/satellite.md
+++ b/docs/operate/satellite.md
@@ -11,7 +11,7 @@ Satellite is off by default (`satellite.enabled: false`) and its image tag has n
 
 ```shell
 helm upgrade --install "${SKYWALKING_RELEASE_NAME}" \
-  oci://registry-1.docker.io/apache/skywalking-helm \
+  oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   -n "${SKYWALKING_RELEASE_NAMESPACE}" \
   --set oap.image.tag=11.0.0 \
diff --git a/docs/operate/scaling.md b/docs/operate/scaling.md
index 3b5c8a9..c236bb4 100644
--- a/docs/operate/scaling.md
+++ b/docs/operate/scaling.md
@@ -63,7 +63,7 @@ namespaced `pods` read permission yourself, or OAP starts and never discovers a
 
 ```shell
 helm install skywalking \
-  oci://registry-1.docker.io/apache/skywalking-helm \
+  oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   -n skywalking --create-namespace \
   --set oap.image.tag=11.0.0 \
diff --git a/docs/reference/skywalking-chart-values.md b/docs/reference/skywalking-chart-values.md
index fbcc0f8..9b69164 100644
--- a/docs/reference/skywalking-chart-values.md
+++ b/docs/reference/skywalking-chart-values.md
@@ -279,7 +279,7 @@ helm install my-release chart/skywalking -f my-values.yaml
 ```
 
 Released versions install from the OCI reference instead —
-`oci://registry-1.docker.io/apache/skywalking-helm --version <x.y.z>`. See
+`oci://docker.io/apache/skywalking-helm --version <x.y.z>`. See
 [Chart sources](../install/chart-sources.md).
 
 > **Tip**: You can use the default [values.yaml](../../chart/skywalking/values.yaml)
diff --git a/docs/storage/banyandb.md b/docs/storage/banyandb.md
index 588cd71..f3de121 100644
--- a/docs/storage/banyandb.md
+++ b/docs/storage/banyandb.md
@@ -12,7 +12,7 @@ when `banyandb.enabled=true`.
 ## Install
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --create-namespace \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
@@ -72,7 +72,7 @@ installs.
 Cluster mode:
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --create-namespace \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
@@ -162,7 +162,7 @@ To point OAP at a BanyanDB cluster the chart does not manage, leave the subchart
 addresses directly:
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --create-namespace \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
diff --git a/docs/storage/choose-a-backend.md b/docs/storage/choose-a-backend.md
index 3937e2a..4746e87 100644
--- a/docs/storage/choose-a-backend.md
+++ b/docs/storage/choose-a-backend.md
@@ -57,7 +57,7 @@ carry `valueFrom`) or `oap.envFromSecret`.
 BanyanDB (standalone is the chart's default BanyanDB mode):
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   --set oap.image.tag=11.0.0 \
   --set ui.image.tag=horizon-1.0.0 \
@@ -74,7 +74,7 @@ See [Version Compatibility](../evaluate/version-compatibility.md).
 Elasticsearch (the default):
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   --set oap.image.tag=11.0.0 \
   --set ui.image.tag=horizon-1.0.0 \
@@ -89,7 +89,7 @@ helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
 PostgreSQL, demo only:
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   --set oap.image.tag=11.0.0 \
   --set ui.image.tag=horizon-1.0.0 \
diff --git a/docs/storage/elasticsearch.md b/docs/storage/elasticsearch.md
index 3f9136e..1a056b7 100644
--- a/docs/storage/elasticsearch.md
+++ b/docs/storage/elasticsearch.md
@@ -45,7 +45,7 @@ Then install SkyWalking with `--set eck-operator.installCRDs=false` so the bundl
 try to create the same CRDs a second time:
 
 ```shell
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm install skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   -n "${SKYWALKING_RELEASE_NAMESPACE}" \
   --set oap.image.tag=11.0.0 \
diff --git a/docs/storage/postgresql.md b/docs/storage/postgresql.md
index cca1a9b..6c08f8a 100644
--- a/docs/storage/postgresql.md
+++ b/docs/storage/postgresql.md
@@ -42,7 +42,7 @@ Any other key under `postgresql.` is passed straight through to the Bitnami subc
 
 ```shell
 helm install skywalking \
-  oci://registry-1.docker.io/apache/skywalking-helm \
+  oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   -n default \
   --set oap.image.tag=11.0.0 \
@@ -80,7 +80,7 @@ postgresql:
 
 ```shell
 helm install skywalking \
-  oci://registry-1.docker.io/apache/skywalking-helm \
+  oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   -n default \
   --set oap.image.tag=11.0.0 \
diff --git a/docs/troubleshooting/install-and-startup.md b/docs/troubleshooting/install-and-startup.md
index f06a04d..7cbf5ce 100644
--- a/docs/troubleshooting/install-and-startup.md
+++ b/docs/troubleshooting/install-and-startup.md
@@ -66,7 +66,7 @@ helm install eck-crds eck-operator-crds \
   --repo https://helm.elastic.co --version 3.3.1 \
   -n skywalking --create-namespace
 
-helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm --version 5.0.0 \
+helm install skywalking oci://docker.io/apache/skywalking-helm --version 5.0.0 \
   -n skywalking \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=elasticsearch \
diff --git a/docs/ui/logins.md b/docs/ui/logins.md
index 0369c59..9d84a6b 100644
--- a/docs/ui/logins.md
+++ b/docs/ui/logins.md
@@ -60,7 +60,7 @@ ui:
 
 ```shell
 helm install "${SKYWALKING_RELEASE_NAME}" \
-  oci://registry-1.docker.io/apache/skywalking-helm \
+  oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   -n "${SKYWALKING_RELEASE_NAMESPACE}" \
   --set oap.image.tag=11.0.0 \
@@ -125,7 +125,7 @@ ui:
 
 ```shell
 helm install "${SKYWALKING_RELEASE_NAME}" \
-  oci://registry-1.docker.io/apache/skywalking-helm \
+  oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 \
   -n "${SKYWALKING_RELEASE_NAMESPACE}" \
   --set oap.image.tag=11.0.0 \
diff --git a/docs/upgrade/upgrading.md b/docs/upgrade/upgrading.md
index 087240f..d98a605 100644
--- a/docs/upgrade/upgrading.md
+++ b/docs/upgrade/upgrading.md
@@ -6,7 +6,7 @@ UI removal, the OAP 11 dashboard-template changes, and the new `ui.config` defau
 ## Run the upgrade
 
 ```shell
-helm upgrade skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm upgrade skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking \
   --set oap.image.tag=11.0.0 \
   --set oap.storageType=banyandb \
@@ -199,7 +199,7 @@ To force a rerun without changing a value, delete the Job and upgrade again:
 
 ```shell
 kubectl delete job -n skywalking -l release=skywalking
-helm upgrade skywalking oci://registry-1.docker.io/apache/skywalking-helm \
+helm upgrade skywalking oci://docker.io/apache/skywalking-helm \
   --version 5.0.0 -n skywalking --reuse-values
 ```
 
diff --git a/tools/releasing/release-passed.sh b/tools/releasing/release-passed.sh
index 7ebe17a..f132ba0 100755
--- a/tools/releasing/release-passed.sh
+++ b/tools/releasing/release-passed.sh
@@ -48,6 +48,12 @@ log()  { echo "  $*"; }
 step() { echo; echo "=== $* ==="; }
 die()  { echo "ERROR: $*" >&2; exit 1; }
 
+# Script scope, over a script-scope variable: an EXIT trap runs after the function has returned and
+# cannot see a `local`, and under `set -u` the unbound name would make the trap itself fail.
+NOTES_FILE=""
+cleanup() { [[ -n "${NOTES_FILE}" ]] && rm -f "${NOTES_FILE}"; return 0; }
+trap cleanup EXIT
+
 ask() {
   # `read` exits 1 at EOF, which under set -e would kill the run with no message.
   local reply
@@ -173,6 +179,45 @@ remove_previous() {
   fi
 }
 
+# The release page used to carry a single line pointing at the changelog. Nobody follows a link to
+# find out what changed in a release they are already looking at, and every release before 5.0.0
+# carried its full notes inline. This rebuilds that: the curated changelog section for this version,
+# then GitHub's own generated list of merged PRs and new contributors.
+build_release_notes() {
+  NOTES_FILE=$(mktemp)
+
+  # After release.sh's next-version PR merges the section lives in its own file; before that it is
+  # still the current changelog. Try both.
+  local src=""
+  for candidate in "docs/changes/changes-${VERSION}.md" "docs/changes/changes.md"; do
+    if [[ -f "${candidate}" ]] && grep -qx "## ${VERSION}" "${candidate}"; then src="${candidate}"; break; fi
+  done
+
+  if [[ -n "${src}" ]]; then
+    # The section runs from its own heading to the next one. Relative links resolve inside docs/
+    # but not on a release page, so point them at the hosted docs for this tag.
+    awk -v want="## ${VERSION}" '$0 == want {f=1; next} f && /^## / {exit} f' "${src}" \
+      | sed -E "s#\]\(\.\./([^)]+)\.md\)#](https://skywalking.apache.org/docs/skywalking-helm/${TAG}/\1/)#g" \
+      | sed '/./,$!d' \
+      > "${NOTES_FILE}"
+    log "notes: ${VERSION} section of ${src}"
+  else
+    echo "See https://github.com/apache/skywalking-helm/blob/${TAG}/docs/changes/changes.md" > "${NOTES_FILE}"
+    log "WARNING: no '## ${VERSION}' section found in docs/changes/ -- falling back to a link"
+  fi
+
+  # Appended rather than passed as --generate-notes, so the body is assembled here and the exact
+  # text is known before anything is published.
+  local generated
+  generated=$(gh api -X POST repos/apache/skywalking-helm/releases/generate-notes \
+                -f tag_name="${TAG}" -q .body 2>/dev/null || true)
+  if [[ -n "${generated}" ]]; then
+    printf '\n---\n\n%s\n' "${generated}" >> "${NOTES_FILE}"
+  else
+    log "WARNING: could not generate the merged-PR list; notes carry the changelog only"
+  fi
+}
+
 github_release() {
   step "Create the GitHub release"
 
@@ -186,6 +231,8 @@ github_release() {
     return
   fi
 
+  build_release_notes
+
   if confirm "gh release create ${TAG} (this publishes the chart to Docker Hub)"; then
     # --verify-tag: without it gh CREATES a missing tag from the default branch
     # head, which is not necessarily the commit the PMC voted on.
@@ -193,7 +240,7 @@ github_release() {
       --repo apache/skywalking-helm \
       --verify-tag \
       --title "${VERSION}" \
-      --notes "See https://github.com/apache/skywalking-helm/blob/${TAG}/docs/changes/changes.md"
+      --notes-file "${NOTES_FILE}"
     log "created -- watch the publish-helm workflow"
     gh run list --repo apache/skywalking-helm --workflow=publish-helm.yaml --limit 1 2>/dev/null || true
   fi
@@ -219,7 +266,7 @@ storage backend -- on Kubernetes with Helm 3.
 
 Install:
 
-  helm install skywalking oci://registry-1.docker.io/apache/skywalking-helm --version ${VERSION} \\
+  helm install skywalking oci://docker.io/apache/skywalking-helm --version ${VERSION} \\
     --set oap.image.tag=<oap-version> \\
     --set ui.image.tag=<horizon-version> \\
     --set oap.storageType=elasticsearch