diff --git a/.github/scripts/ci.sh b/.github/scripts/ci.sh
index b59d96e7..7cd8036f 100755
--- a/.github/scripts/ci.sh
+++ b/.github/scripts/ci.sh
@@ -1,6 +1,9 @@
 #! /usr/bin/env bash
 set -euo pipefail
 
+# Keep empty so each component uses its own default repository URL.
+readonly DEFAULT_GIT_URL=""
+
 function check_image_existed() {
     local img=$1
     # skip the check if the image starts with "hub.pingcap.net" which is the internal image.
@@ -34,7 +37,7 @@ function test_get_builder() {
             for os in $operating_systems; do
                 for ac in $architectures; do
                     echo -en "[🚢] $cm $os $ac $version $profile:\t"
-                    img=$($script "$cm" "$os" "$ac" "$version" "$profile")
+                    img=$($script "$cm" "$os" "$ac" "$version" "$profile" "" "" "$DEFAULT_GIT_URL")
                     echo $img
                     check_image_existed $img
                 done
@@ -49,7 +52,7 @@ function test_get_builder() {
         for os in $operating_systems; do
             for ac in $architectures; do
                 echo -en "[🚢] $cm $os $ac $version $profile:\t"
-                img=$($script "$cm" "$os" "$ac" "$version" "$profile")
+                img=$($script "$cm" "$os" "$ac" "$version" "$profile" "" "" "$DEFAULT_GIT_URL")
                 echo $img
                 check_image_existed $img
             done
@@ -63,7 +66,7 @@ function test_get_builder() {
             for os in $operating_systems; do
                 for ac in $architectures; do
                     echo -en "[🚢] $cm $os $ac $version enterprise:\t"
-                    img=$($script "$cm" "$os" "$ac" "$version" enterprise)
+                    img=$($script "$cm" "$os" "$ac" "$version" enterprise "" "" "$DEFAULT_GIT_URL")
                     echo $img
                     check_image_existed $img
                 done
@@ -80,7 +83,7 @@ function test_get_builder() {
             for os in $operating_systems; do
                 for ac in $architectures; do
                     echo -en "[🚢] $cm $os $ac $version $profile:\t"
-                    img=$($script "$cm" "$os" "$ac" "$version" $profile)
+                    img=$($script "$cm" "$os" "$ac" "$version" $profile "" "" "$DEFAULT_GIT_URL")
                     echo $img
                     check_image_existed $img
                 done
@@ -102,7 +105,7 @@ function test_get_builder_freedom_releasing() {
     for ac in $architectures; do
         for version in v2.0.0 v1.6.0 v1.5.0; do
             echo -en "[🚢] $cm $os $ac $version $profile:\t"
-            $script "$cm" "$os" "$ac" "$version" $profile
+            $script "$cm" "$os" "$ac" "$version" $profile "" "" "$DEFAULT_GIT_URL"
         done
     done
 
@@ -113,7 +116,7 @@ function test_get_builder_freedom_releasing() {
     for ac in $architectures; do
         for version in v6.4.0-20221102-1667359250 v20221018; do
             echo -en "[🚢] $cm $os $ac $version $profile:\t"
-            $script "$cm" "$os" "$ac" "$version" $profile
+            $script "$cm" "$os" "$ac" "$version" $profile "" "" "$DEFAULT_GIT_URL"
         done
     done
 
@@ -123,7 +126,7 @@ function test_get_builder_freedom_releasing() {
     for ac in $architectures; do
         for version in v0.5.0 v0.6.0; do
             echo -en "[🚢] $cm $os $ac $version $profile:\t"
-            $script "$cm" "$os" "$ac" "$version" $profile
+            $script "$cm" "$os" "$ac" "$version" $profile "" "" "$DEFAULT_GIT_URL"
         done
     done
 
@@ -133,7 +136,7 @@ function test_get_builder_freedom_releasing() {
         for ac in $architectures; do
             for version in v0.1.2 v0.1.3; do
                 echo -en "[🚢] $cm $os $ac $version $profile:\t"
-                $script "$cm" "$os" "$ac" "$version" $profile
+                $script "$cm" "$os" "$ac" "$version" $profile "" "" "$DEFAULT_GIT_URL"
             done
         done
     done
@@ -144,7 +147,7 @@ function test_get_builder_freedom_releasing() {
         for ac in $architectures; do
             for version in v0.1.0 v0.2.0; do
                 echo -en "[🚢] $cm $os $ac $version $profile:\t"
-                $script "$cm" "$os" "$ac" "$version" $profile
+                $script "$cm" "$os" "$ac" "$version" $profile "" "" "$DEFAULT_GIT_URL"
             done
         done
     done
@@ -169,7 +172,7 @@ function test_gen_package_artifacts_script() {
             for os in $operating_systems; do
                 for ac in $architectures; do
                     echo -en "[📃📦] $cm $os $ac $version $profile:\t"
-                    $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef
+                    $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
                     shellcheck -S error packages/scripts/build-package-artifacts.sh
                 done
             done
@@ -184,7 +187,7 @@ function test_gen_package_artifacts_script() {
             for os in $operating_systems; do
                 for ac in $architectures; do
                     echo -en "[📃📦] $cm $os $ac $version $profile:\t"
-                    $script "$cm" "$os" "$ac" "$version" enterprise branch-xxx 123456789abcdef
+                    $script "$cm" "$os" "$ac" "$version" enterprise branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
                     shellcheck -S error packages/scripts/build-package-artifacts.sh
                 done
             done
@@ -199,7 +202,7 @@ function test_gen_package_artifacts_script() {
             for os in $operating_systems; do
                 for ac in $architectures; do
                     echo -en "[📃📦] $cm $os $ac $version $profile:\t"
-                    $script "$cm" "$os" "$ac" "$version" failpoint branch-xxx 123456789abcdef
+                    $script "$cm" "$os" "$ac" "$version" failpoint branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
                     shellcheck -S error packages/scripts/build-package-artifacts.sh
                 done
             done
@@ -215,7 +218,7 @@ function test_gen_package_artifacts_script() {
             for os in $operating_systems; do
                 for ac in $architectures; do
                     echo -en "[📃📦] $cm $os $ac $version $profile:\t"
-                    $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef
+                    $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
                     shellcheck -S error packages/scripts/build-package-artifacts.sh
                 done
             done
@@ -236,7 +239,7 @@ function test_gen_package_artifacts_script_freedom_releasing() {
     for ac in $architectures; do
         for version in v2.0.0 v1.6.0 v1.5.0; do
             echo -en "[📃📦] $cm $os $ac $version $profile:\t"
-            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef
+            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-artifacts.sh
         done
     done
@@ -247,7 +250,7 @@ function test_gen_package_artifacts_script_freedom_releasing() {
     for ac in $architectures; do
         for version in v6.4.0-20221102-1667359250 v20221018; do
             echo -en "[📃📦] $cm $os $ac $version $profile:\t"
-            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef
+            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-artifacts.sh
         done
     done
@@ -258,7 +261,7 @@ function test_gen_package_artifacts_script_freedom_releasing() {
     for ac in $architectures; do
         for version in v0.5.0 v0.6.0; do
             echo -en "[📃📦] $cm $os $ac $version $profile:\t"
-            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef
+            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-artifacts.sh
         done
     done
@@ -269,7 +272,7 @@ function test_gen_package_artifacts_script_freedom_releasing() {
     for ac in $architectures; do
         for version in v0.1.2 v0.1.3; do
             echo -en "[📃📦] $cm $os $ac $version $profile:\t"
-            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef
+            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-artifacts.sh
         done
     done
@@ -280,7 +283,7 @@ function test_gen_package_artifacts_script_freedom_releasing() {
     for ac in $architectures; do
         for version in v0.1.0 v0.2.0; do
             echo -en "[📃📦] $cm $os $ac $version $profile:\t"
-            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef
+            $script "$cm" "$os" "$ac" "$version" $profile branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-artifacts.sh
         done
     done
@@ -304,7 +307,7 @@ function test_gen_package_images_script() {
             fi
             for ac in $architectures; do
                 echo -en "[📃💿] $cm $os $ac $version $profile:\t"
-                $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef
+                $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
                 shellcheck -S error packages/scripts/build-package-images.sh
             done
         done
@@ -317,7 +320,7 @@ function test_gen_package_images_script() {
         for version in $versions; do
             for ac in $architectures; do
                 echo -en "[📃💿] $cm $os $ac $version $profile:\t"
-                $script $cm $os $ac $version $profile branch-xxx 123456789abcdef
+                $script $cm $os $ac $version $profile branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
                 shellcheck -S error packages/scripts/build-package-images.sh
             done
         done
@@ -331,7 +334,7 @@ function test_gen_package_images_script() {
         for version in $versions; do
             for ac in $architectures; do
                 echo -en "[📃💿] $cm $os $ac $version $profile:\t"
-                $script $cm $os $ac $version $profile branch-xxx 123456789abcdef
+                $script $cm $os $ac $version $profile branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
                 shellcheck -S error packages/scripts/build-package-images.sh
             done
         done
@@ -350,7 +353,7 @@ function test_gen_package_images_script_freedom_releasing() {
     for ac in $architectures; do
         for version in v2.0.0 v1.6.0 v1.5.0; do
             echo -en "[📃💿] $cm $os $ac $version $profile:\t"
-            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef
+            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-images.sh
         done
     done
@@ -360,7 +363,7 @@ function test_gen_package_images_script_freedom_releasing() {
     for ac in $architectures; do
         for version in v6.4.0-20221102-1667359250 v20221018; do
             echo -en "[📃💿] $cm $os $ac $version $profile:\t"
-            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef
+            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-images.sh
         done
     done
@@ -370,7 +373,7 @@ function test_gen_package_images_script_freedom_releasing() {
     for version in v0.5.0 v0.6.0; do
         for ac in $architectures; do
             echo -en "[📃💿] $cm $os $ac $version $profile:\t"
-            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef
+            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-images.sh
         done
     done
@@ -380,7 +383,7 @@ function test_gen_package_images_script_freedom_releasing() {
     for ac in $architectures; do
         for version in v0.1.2 v0.1.3; do
             echo -en "[📃💿] $cm $os $ac $version $profile:\t"
-            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef
+            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-images.sh
         done
     done
@@ -390,7 +393,7 @@ function test_gen_package_images_script_freedom_releasing() {
     for version in v0.1.0 v0.2.0; do
         for ac in $architectures; do
             echo -en "[📃💿] $cm $os $ac $version $profile:\t"
-            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef
+            $script "$cm" linux "$ac" "$version" "$profile" branch-xxx 123456789abcdef "" "" us-docker.pkg.dev/pingcap-testing-account/hub "$DEFAULT_GIT_URL"
             shellcheck -S error packages/scripts/build-package-images.sh
         done
     done
diff --git a/packages/README.md b/packages/README.md
index e06202ef..fe91bda3 100644
--- a/packages/README.md
+++ b/packages/README.md
@@ -37,6 +37,7 @@ You can get them by run:
 $ grep -oE "{{\s*\..*?}}" packages/packages.yaml.tmpl | grep -oE "\.\w+(\.\w+)*" | sort -u
 .Git.ref
 .Git.sha
+.Git.url
 .Release.arch
 .Release.os
 .Release.version
diff --git a/packages/packages.yaml.tmpl b/packages/packages.yaml.tmpl
index 940a6280..eb9ea7c5 100644
--- a/packages/packages.yaml.tmpl
+++ b/packages/packages.yaml.tmpl
@@ -26,7 +26,7 @@ components:
   advanced-statefulset:
     desc:
     git:
-      url: https://github.com/pingcap/advanced-statefulset.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/advanced-statefulset.git" }}'
       ref: '{{ .Git.ref | default "master" }}'
       sha: '{{ .Git.sha | default "" }}'
     version: {{ .Release.version }} # segment version.
@@ -56,7 +56,7 @@ components:
   ctl:
     desc: ctl components
     git:
-      url: https://github.com/pingcap/tidb.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tidb.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: '{{ .Git.sha | default "" }}'
     version: {{ .Release.version }} # segment version.
@@ -263,7 +263,7 @@ components:
   monitoring:
     desc:
     git:
-      url: https://github.com/pingcap/monitoring.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/monitoring.git" }}'
       ref: '{{ .Git.ref | default "master" }}'
       sha: '{{ .Git.sha | default "" }}'
     version: {{ .Release.version }} # segment version.
@@ -420,7 +420,7 @@ components:
   ng-monitoring:
     desc: ng-monitoring component
     git:
-      url: https://github.com/pingcap/ng-monitoring.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/ng-monitoring.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -544,7 +544,7 @@ components:
   pd:
     desc: pd server component tarball
     git:
-      url: https://github.com/tikv/pd.git
+      url: '{{ .Git.url | default "https://github.com/tikv/pd.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -891,7 +891,7 @@ components:
   tidb:
     desc: tidb server component tarball
     git:
-      url: https://github.com/pingcap/tidb.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tidb.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -1368,7 +1368,7 @@ components:
   tidb-tools:
     desc: tidb tools component tarball
     git:
-      url: https://github.com/pingcap/tidb-tools.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tidb-tools.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -1416,7 +1416,7 @@ components:
   tidb-ctl:
     desc: tidb ctl component tarball
     git:
-      url: https://github.com/pingcap/tidb-ctl.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tidb-ctl.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -1455,7 +1455,7 @@ components:
       [Deprecated] Delcared Deprecation in v8.3.0, removed in v8.4.0
       tidb binlog component tarball
     git:
-      url: https://github.com/pingcap/tidb-binlog.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tidb-binlog.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -1545,7 +1545,7 @@ components:
   tidb-operator:
     desc: tidb opreator component tarball
     git:
-      url: https://github.com/pingcap/tidb-operator.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tidb-operator.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -1717,7 +1717,7 @@ components:
   tidb-dashboard:
     desc: ''
     git:
-      url: https://github.com/pingcap/tidb-dashboard.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tidb-dashboard.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -1844,7 +1844,7 @@ components:
   tiflash:
     desc: tiflash components tarball
     git:
-      url: https://github.com/pingcap/tiflash.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tiflash.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -2196,7 +2196,7 @@ components:
   tiflow:
     desc: tiflow components
     git:
-      url: https://github.com/pingcap/tiflow.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tiflow.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -2739,7 +2739,7 @@ components:
   ticdc:
     desc: ticdc components
     git:
-      url: https://github.com/pingcap/ticdc.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/ticdc.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -2816,7 +2816,7 @@ components:
   tiflow-operator:
     desc: tiflow operator components tarball
     git:
-      url: https://github.com/pingcap/tiflow-operator.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tiflow-operator.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -2848,7 +2848,7 @@ components:
   tikv:
     desc: tikv components tarball
     git:
-      url: https://github.com/tikv/tikv.git
+      url: '{{ .Git.url | default "https://github.com/tikv/tikv.git" }}'
       ref: {{ .Git.ref | default "master" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -3096,7 +3096,7 @@ components:
   tiproxy:
     desc: tiproxy components tarballs and images
     git:
-      url: https://github.com/pingcap/tiproxy.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tiproxy.git" }}'
       ref: {{ .Git.ref | default "main" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -3148,7 +3148,7 @@ components:
     desc: tici components tarballs and images
     git:
       # In the future, the repo will be open source in the `pingcap` ORG.
-      url: https://github.com/pingcap-inc/tici.git
+      url: '{{ .Git.url | default "https://github.com/pingcap-inc/tici.git" }}'
       ref: {{ .Git.ref | default "main" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
@@ -3195,7 +3195,7 @@ components:
     desc: tiup components tarballs and images
     git:
       # In the future, the repo will be open source in the `pingcap` ORG.
-      url: https://github.com/pingcap/tiup.git
+      url: '{{ .Git.url | default "https://github.com/pingcap/tiup.git" }}'
       ref: {{ .Git.ref | default "main" }}
       sha: {{ .Git.sha | default "" }}
     version: {{ .Release.version }} # segment version.
diff --git a/packages/scripts/build-package-artifacts.sh.tmpl b/packages/scripts/build-package-artifacts.sh.tmpl
index e29a695e..79406291 100644
--- a/packages/scripts/build-package-artifacts.sh.tmpl
+++ b/packages/scripts/build-package-artifacts.sh.tmpl
@@ -243,6 +243,12 @@ function archive() {
 {{ if has .artifactory "package_repo" -}}
 function prepare_artifact_config() {
     local save_file="$1"
+    local source_url
+
+    source_url="${GIT_URL:-$(cat <<'EOF'
+{{ .git.url | default "https://github.com/unknown/unknown.git" }}
+EOF
+)}"
 
     :> "$save_file"
     # Inject OCI standard metadata labels and PingCAP build labels.
@@ -250,7 +256,6 @@ function prepare_artifact_config() {
         .["org.opencontainers.image.version"] = "{{ .version }}" |
         .["org.opencontainers.image.title"] = "{{ .component }}" |
         .["org.opencontainers.image.licenses"] = "{{ .license | default "Apache-2.0" }}" |
-        .["org.opencontainers.image.source"] = "{{ .git.url }}" |
         .["org.opencontainers.image.ref.name"] = "{{ .git.ref }}" |
         .["org.opencontainers.image.revision"] = "{{ .git.sha }}" |
         .["net.pingcap.tibuild.os"] = "{{ .os }}" |
@@ -259,6 +264,7 @@ function prepare_artifact_config() {
         .["net.pingcap.tibuild.git-sha"] = "{{ .git.sha }}" |
         .["net.pingcap.tibuild.tiup"] = []
     ' "$save_file"
+    SOURCE_URL="$source_url" yq -p json -o json -i '.["org.opencontainers.image.source"] = strenv(SOURCE_URL)' "$save_file"
 
     {{- if has (coll.Slice "release" "next-gen") .profile }}
     {{- range (.artifacts | jq `map(select((.type == "file" or .type == null) and .if != false and .tiup != null))`) }}
diff --git a/packages/scripts/build-package-images.sh.tmpl b/packages/scripts/build-package-images.sh.tmpl
index 4f170221..51b91b29 100644
--- a/packages/scripts/build-package-images.sh.tmpl
+++ b/packages/scripts/build-package-images.sh.tmpl
@@ -147,6 +147,10 @@ build_and_push_images() {
     release_ws="$1"
     digests_file="$2"
     kaniko_executor="$3"
+    source_url="${GIT_URL:-$(cat <<'EOF'
+{{ .git.url | default "https://github.com/unknown/unknown.git" }}
+EOF
+)}"
 
     ################# build and push image ################
     tag="{{ index $tags 0 }}"
@@ -158,7 +162,7 @@ build_and_push_images() {
     {{ end }}
     kaniko_global_options="$kaniko_global_options --label org.opencontainers.image.title={{ .component }}"
     kaniko_global_options="$kaniko_global_options --label org.opencontainers.image.licenses={{ .license | default "Apache-2.0" }}"
-    kaniko_global_options="$kaniko_global_options --label org.opencontainers.image.source={{ .git.url }}"
+    kaniko_global_options="$kaniko_global_options --label org.opencontainers.image.source=${source_url}"
     kaniko_global_options="$kaniko_global_options --label org.opencontainers.image.ref.name={{ .git.ref }}"
     {{ if .git.sha }}
     kaniko_global_options="$kaniko_global_options --label org.opencontainers.image.revision={{ .git.sha }}"
diff --git a/packages/scripts/gen-package-artifacts-with-config.sh b/packages/scripts/gen-package-artifacts-with-config.sh
index 6f0e12fd..1d2ebff9 100755
--- a/packages/scripts/gen-package-artifacts-with-config.sh
+++ b/packages/scripts/gen-package-artifacts-with-config.sh
@@ -14,7 +14,8 @@ function main() {
     local git_sha=$7
     local template_file="${8:-${PROJECT_ROOT_DIR}/packages/packages.yaml.tmpl}"
     local out_file="${9:-${RELEASE_SCRIPTS_DIR}/build-package-artifacts.sh}"
-    local registry="${10:-hub.pingcap.net}"
+    local registry="${10:-us-docker.pkg.dev/pingcap-testing-account/hub}"
+    local git_url="${11:-}"
     local target_info="component: $component, os: $os, arch: $arch, version: $version, profile: $profile"
 
     # prepare template file's context.
@@ -26,6 +27,7 @@ function main() {
     yq -i ".Release.registry = \"$registry\"" release-context.yaml
     yq -i ".Git.ref = \"$git_ref\"" release-context.yaml
     yq -i ".Git.sha = \"$git_sha\"" release-context.yaml
+    yq -i ".Git.url = \"$git_url\"" release-context.yaml
 
     gomplate --context .=release-context.yaml -f "$template_file" --out release-packages.yaml
     yq ".components[\"${component}\"]" release-packages.yaml >release-package.yaml
diff --git a/packages/scripts/gen-package-images-with-config.sh b/packages/scripts/gen-package-images-with-config.sh
index 6263880b..3242aba8 100755
--- a/packages/scripts/gen-package-images-with-config.sh
+++ b/packages/scripts/gen-package-images-with-config.sh
@@ -14,7 +14,8 @@ function main() {
     local git_sha=$7
     local template_file="${8:-${PROJECT_ROOT_DIR}/packages/packages.yaml.tmpl}"
     local out_file="${9:-${RELEASE_SCRIPTS_DIR}/build-package-images.sh}"
-    local registry="${10:-hub.pingcap.net}"
+    local registry="${10:-us-docker.pkg.dev/pingcap-testing-account/hub}"
+    local git_url="${11:-}"
     local target_info="component: $component, os: $os, arch: $arch, version: $version, profile: $profile"
 
     if [ "$os" != "linux" ]; then
@@ -31,6 +32,7 @@ function main() {
     yq -i ".Release.registry = \"$registry\"" release-context.yaml
     yq -i ".Git.ref = \"$git_ref\"" release-context.yaml
     yq -i ".Git.sha = \"$git_sha\"" release-context.yaml
+    yq -i ".Git.url = \"$git_url\"" release-context.yaml
 
     gomplate --context .=release-context.yaml -f "$template_file" --out release-packages.yaml
     yq ".components[\"${component}\"]" release-packages.yaml >release-package.yaml
diff --git a/packages/scripts/get-package-builder-with-config.sh b/packages/scripts/get-package-builder-with-config.sh
index a3fd94eb..9739aa1a 100755
--- a/packages/scripts/get-package-builder-with-config.sh
+++ b/packages/scripts/get-package-builder-with-config.sh
@@ -12,6 +12,7 @@ function main() {
     local profile=$5
     local template_file="${6:-${PROJECT_ROOT_DIR}/packages/packages.yaml.tmpl}"
     local out_file="${7:-build-package-builder.txt}"
+    local git_url="${8:-}"
     local target_info="component: $component, os: $os, arch: $arch, version: $version, profile: $profile"
 
     # prepare template file's context.
@@ -23,6 +24,7 @@ function main() {
     yq -i '.Release.registry = "localhost"' release-context.yaml
     yq -i '.Git.ref = ""' release-context.yaml
     yq -i '.Git.sha = ""' release-context.yaml
+    yq -i ".Git.url = \"$git_url\"" release-context.yaml
 
     gomplate --context .=release-context.yaml -f "$template_file" --out release-packages.yaml
     yq ".components[\"${component}\"]" release-packages.yaml >release-package.yaml