diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27f85ff6..11e229bf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -325,6 +325,9 @@ jobs:
 
   build:
     runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
     env:
       PUBLISH_IMAGE: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
     strategy:
@@ -356,13 +359,13 @@ jobs:
       - uses: docker/login-action@v3
         if: env.PUBLISH_IMAGE == 'true'
         with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: quay.io/gkrumbach07/openshell-dashboard
+          images: ghcr.io/ai-openshell/console
       - uses: docker/build-push-action@v6
         id: build
         with:
@@ -380,7 +383,7 @@ jobs:
             DASHBOARD_COMMIT=${{ github.sha }}
           cache-from: type=gha,scope=${{ matrix.platform }}
           cache-to: type=gha,scope=${{ matrix.platform }},mode=max
-          outputs: ${{ env.PUBLISH_IMAGE == 'true' && 'type=image,name=quay.io/gkrumbach07/openshell-dashboard,push-by-digest=true,name-canonical=true,push=true' || '' }}
+          outputs: ${{ env.PUBLISH_IMAGE == 'true' && 'type=image,name=ghcr.io/ai-openshell/console,push-by-digest=true,name-canonical=true,push=true' || '' }}
       - name: Export digest
         if: env.PUBLISH_IMAGE == 'true'
         run: |
@@ -410,6 +413,9 @@ jobs:
   push-manifest:
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     needs: [build]
     steps:
       - uses: actions/download-artifact@v4
@@ -420,13 +426,13 @@ jobs:
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: quay.io/gkrumbach07/openshell-dashboard
+          images: ghcr.io/ai-openshell/console
           # sha-<first 7 characters of the commit> is how every later tag finds
           # this image: promote-latest below, and the version tags publish.yml
           # adds when a release is cut. Keep the format in step with both.
@@ -438,7 +444,7 @@ jobs:
         run: |
           docker buildx imagetools create \
             $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf 'quay.io/gkrumbach07/openshell-dashboard@sha256:%s ' *)
+            $(printf 'ghcr.io/ai-openshell/console@sha256:%s ' *)
 
   # Reads the image that push-manifest just pushed back from the registry and
   # checks that its labels declare the gateway release line and the SDK on both
@@ -453,14 +459,24 @@ jobs:
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     needs: [push-manifest]
+    permissions:
+      contents: read
+      packages: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
       - uses: docker/setup-buildx-action@v3
+      # A new GHCR package is private until an org admin makes it public, and
+      # reading a private image needs a login.
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: The pushed image declares its gateway release line
-        run: node scripts/check-image-range.mjs "quay.io/gkrumbach07/openshell-dashboard:sha-${GITHUB_SHA::7}"
+        run: node scripts/check-image-range.mjs "ghcr.io/ai-openshell/console:sha-${GITHUB_SHA::7}"
 
   # `latest` only moves to a commit that passed everything, and only forward.
   #
@@ -488,6 +504,9 @@ jobs:
   promote-latest:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     needs:
       [
         push-manifest,
@@ -513,12 +532,12 @@ jobs:
       - uses: docker/login-action@v3
         if: steps.tip.outputs.is_tip == 'true'
         with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Point latest at this commit's image
         if: steps.tip.outputs.is_tip == 'true'
-        run: scripts/retag-image.sh quay.io/gkrumbach07/openshell-dashboard "sha-${GITHUB_SHA::7}" latest
+        run: scripts/retag-image.sh ghcr.io/ai-openshell/console "sha-${GITHUB_SHA::7}" latest
 
   # Dev charts are deliberately floating. Stable chart versions are published
   # only from publish.yml after the versioned container image has been tagged.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3ac57087..276cccc9 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -212,7 +212,7 @@ jobs:
   # released, sha-<commit> names a new build by now, and retag-image.sh fails
   # here rather than move the release onto it. See docs/releasing.md.
   #
-  # A separate job so that the registry credentials are never in the job that
+  # A separate job so that the package permission is never in the job that
   # holds the repository permissions, and so that a registry hiccup can
   # be retried on its own ("Re-run failed jobs") without touching the release.
   tag-image:
@@ -221,6 +221,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      packages: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
@@ -229,9 +230,9 @@ jobs:
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Tag the image built for this commit with the release version
         env:
           SOURCE_TAG: ${{ needs.publish.outputs.source_tag }}
@@ -239,7 +240,7 @@ jobs:
         run: |
           set -euo pipefail
           read -r -a tags <<< "$IMAGE_TAGS"
-          scripts/retag-image.sh quay.io/gkrumbach07/openshell-dashboard "$SOURCE_TAG" "${tags[@]}"
+          scripts/retag-image.sh ghcr.io/ai-openshell/console "$SOURCE_TAG" "${tags[@]}"
 
   # Packaged from this commit with the image tag that tag-image just published.
   # Never re-push a stable OCI version; an existing version is left unchanged.
diff --git a/README.md b/README.md
index c969f032..640cde74 100644
--- a/README.md
+++ b/README.md
@@ -70,7 +70,7 @@ A dashboard release is for one minor release line of the OpenShell gateway: ever
 
 | Your gateway | Dashboard | Container image |
 |---|---|---|
-| `0.1.x` | `0.1.x` | `quay.io/gkrumbach07/openshell-dashboard:0.1` for the newest release of the line, or an exact `:0.1.N` |
+| `0.1.x` | `0.1.x` | `ghcr.io/ai-openshell/console:0.1` for the newest release of the line, or an exact `:0.1.N`. Releases up to `0.1.3` are at `quay.io/gkrumbach07/openshell-dashboard` |
 | `0.0.116` | the [`gateway-0.0.116`](https://github.com/ai-openshell/console/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` |
 
 `gateway-0.0.116` is a one-off build for gateway `0.0.116` only. It sits outside the version numbering, and no further release is planned for it.
diff --git a/backend/cmd/server/gateway_setup.go b/backend/cmd/server/gateway_setup.go
index ee09dc3c..e9b98f75 100644
--- a/backend/cmd/server/gateway_setup.go
+++ b/backend/cmd/server/gateway_setup.go
@@ -8,8 +8,8 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/clients"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/clients"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 type gatewayClients struct {
diff --git a/backend/cmd/server/gateway_setup_test.go b/backend/cmd/server/gateway_setup_test.go
index cd725dd3..810e43cc 100644
--- a/backend/cmd/server/gateway_setup_test.go
+++ b/backend/cmd/server/gateway_setup_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // captureLogs swaps the default logger for the duration of a test and returns
diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go
index cf80fdb5..8ea4fac0 100644
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -21,9 +21,9 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/server"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/server"
 )
 
 const (
diff --git a/backend/go.mod b/backend/go.mod
index 94665bda..fff0286c 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -1,4 +1,4 @@
-module github.com/Gkrumbach07/openshell-dashboard/backend
+module github.com/ai-openshell/console/backend
 
 go 1.26.7
 
diff --git a/backend/pkg/clients/auth.go b/backend/pkg/clients/auth.go
index 7a3284e3..23a9033c 100644
--- a/backend/pkg/clients/auth.go
+++ b/backend/pkg/clients/auth.go
@@ -3,7 +3,7 @@ package clients
 import (
 	"context"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/auth"
 )
 
 // ContextAuthProvider implements grpc.PerRPCCredentials by reading the JWT
diff --git a/backend/pkg/handlers/allworkspaces_handler.go b/backend/pkg/handlers/allworkspaces_handler.go
index 1cb46e67..6d22bd32 100644
--- a/backend/pkg/handlers/allworkspaces_handler.go
+++ b/backend/pkg/handlers/allworkspaces_handler.go
@@ -5,9 +5,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // AllWorkspacesHandler serves the lists that span every workspace on the
diff --git a/backend/pkg/handlers/allworkspaces_handler_test.go b/backend/pkg/handlers/allworkspaces_handler_test.go
index 04b2f8a1..589184f8 100644
--- a/backend/pkg/handlers/allworkspaces_handler_test.go
+++ b/backend/pkg/handlers/allworkspaces_handler_test.go
@@ -12,8 +12,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/services"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/backend/pkg/handlers/drafts_handler.go b/backend/pkg/handlers/drafts_handler.go
index 7189cb19..9928e548 100644
--- a/backend/pkg/handlers/drafts_handler.go
+++ b/backend/pkg/handlers/drafts_handler.go
@@ -10,9 +10,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // ApproveDraftChunkRequest optionally carries the chunk's review token, which
diff --git a/backend/pkg/handlers/drafts_handler_test.go b/backend/pkg/handlers/drafts_handler_test.go
index d65975b0..6945fa77 100644
--- a/backend/pkg/handlers/drafts_handler_test.go
+++ b/backend/pkg/handlers/drafts_handler_test.go
@@ -10,10 +10,10 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	sdktypes "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // draftRoutes mounts the draft routes on the paths app.go gives them.
diff --git a/backend/pkg/handlers/drafts_summary_handler_test.go b/backend/pkg/handlers/drafts_summary_handler_test.go
index c1ffe612..ecb4d2e5 100644
--- a/backend/pkg/handlers/drafts_summary_handler_test.go
+++ b/backend/pkg/handlers/drafts_summary_handler_test.go
@@ -16,9 +16,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // draftSummaryRoutes mounts the two summary routes on the paths app.go gives
diff --git a/backend/pkg/handlers/files_download_handler_test.go b/backend/pkg/handlers/files_download_handler_test.go
index c1ad5249..c2c36cd6 100644
--- a/backend/pkg/handlers/files_download_handler_test.go
+++ b/backend/pkg/handlers/files_download_handler_test.go
@@ -14,9 +14,9 @@ import (
 	"github.com/go-chi/chi/v5"
 	chimiddleware "github.com/go-chi/chi/v5/middleware"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // loginShellNoise is what a sandbox under the base policy prints on stderr
diff --git a/backend/pkg/handlers/files_handler.go b/backend/pkg/handlers/files_handler.go
index e96a6acc..ee99af77 100644
--- a/backend/pkg/handlers/files_handler.go
+++ b/backend/pkg/handlers/files_handler.go
@@ -15,9 +15,9 @@ import (
 	"time"
 	"unicode/utf8"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 const defaultUploadDir = "/sandbox"
diff --git a/backend/pkg/handlers/files_handler_test.go b/backend/pkg/handlers/files_handler_test.go
index 6b82e997..e34c5206 100644
--- a/backend/pkg/handlers/files_handler_test.go
+++ b/backend/pkg/handlers/files_handler_test.go
@@ -13,8 +13,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestValidateFilePath(t *testing.T) {
diff --git a/backend/pkg/handlers/files_upload_handler_test.go b/backend/pkg/handlers/files_upload_handler_test.go
index ba575e59..a3cde182 100644
--- a/backend/pkg/handlers/files_upload_handler_test.go
+++ b/backend/pkg/handlers/files_upload_handler_test.go
@@ -16,9 +16,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestValidRelativePath(t *testing.T) {
diff --git a/backend/pkg/handlers/gateway_handler.go b/backend/pkg/handlers/gateway_handler.go
index 561297ae..7bd82b1e 100644
--- a/backend/pkg/handlers/gateway_handler.go
+++ b/backend/pkg/handlers/gateway_handler.go
@@ -4,10 +4,10 @@ import (
 	"context"
 	"net/http"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 type GatewayHandler struct {
diff --git a/backend/pkg/handlers/gateway_handler_test.go b/backend/pkg/handlers/gateway_handler_test.go
index b75487d9..7ac7236e 100644
--- a/backend/pkg/handlers/gateway_handler_test.go
+++ b/backend/pkg/handlers/gateway_handler_test.go
@@ -12,10 +12,10 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestGetGateway(t *testing.T) {
diff --git a/backend/pkg/handlers/list_pagination.go b/backend/pkg/handlers/list_pagination.go
index b17da995..031aa15e 100644
--- a/backend/pkg/handlers/list_pagination.go
+++ b/backend/pkg/handlers/list_pagination.go
@@ -6,7 +6,7 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
 )
 
 // listRequestOptions keeps the existing array response unless pageSize was
diff --git a/backend/pkg/handlers/list_pagination_test.go b/backend/pkg/handlers/list_pagination_test.go
index 312c610f..10f8adc8 100644
--- a/backend/pkg/handlers/list_pagination_test.go
+++ b/backend/pkg/handlers/list_pagination_test.go
@@ -11,7 +11,7 @@ import (
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestPagedListRoutesFetchOneGatewayPage(t *testing.T) {
diff --git a/backend/pkg/handlers/logs_handler.go b/backend/pkg/handlers/logs_handler.go
index 93068689..b840e88d 100644
--- a/backend/pkg/handlers/logs_handler.go
+++ b/backend/pkg/handlers/logs_handler.go
@@ -13,9 +13,9 @@ import (
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	pb "github.com/NVIDIA/OpenShell/sdk/go/proto/openshellv1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 const logDefaultLines uint32 = 200
diff --git a/backend/pkg/handlers/logs_handler_test.go b/backend/pkg/handlers/logs_handler_test.go
index 7ea7c237..0076fc90 100644
--- a/backend/pkg/handlers/logs_handler_test.go
+++ b/backend/pkg/handlers/logs_handler_test.go
@@ -12,10 +12,10 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
 	pb "github.com/NVIDIA/OpenShell/sdk/go/proto/openshellv1"
+	"github.com/ai-openshell/console/backend/pkg/services"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
diff --git a/backend/pkg/handlers/mock_sdk_test.go b/backend/pkg/handlers/mock_sdk_test.go
index 1cf99d3e..8eaca70e 100644
--- a/backend/pkg/handlers/mock_sdk_test.go
+++ b/backend/pkg/handlers/mock_sdk_test.go
@@ -25,12 +25,12 @@ type mockSDK struct {
 	files      mockSDKFiles
 }
 
-func (m *mockSDK) Sandboxes() openshell.SandboxInterface    { return &m.sandboxes }
-func (m *mockSDK) Providers() openshell.ProviderInterface   { return &m.providers }
-func (m *mockSDK) Services() openshell.ServiceInterface     { return &m.services }
-func (m *mockSDK) Exec() openshell.ExecInterface            { return &m.exec }
-func (m *mockSDK) Files() openshell.FileInterface           { return &m.files }
-func (m *mockSDK) Health() openshell.HealthInterface        { return &m.health }
+func (m *mockSDK) Sandboxes() openshell.SandboxInterface  { return &m.sandboxes }
+func (m *mockSDK) Providers() openshell.ProviderInterface { return &m.providers }
+func (m *mockSDK) Services() openshell.ServiceInterface   { return &m.services }
+func (m *mockSDK) Exec() openshell.ExecInterface          { return &m.exec }
+func (m *mockSDK) Files() openshell.FileInterface         { return &m.files }
+func (m *mockSDK) Health() openshell.HealthInterface      { return &m.health }
 func (m *mockSDK) SandboxSuspendResume() openshell.SandboxSuspendResumeInterface {
 	panic("not implemented")
 }
diff --git a/backend/pkg/handlers/policies_handler.go b/backend/pkg/handlers/policies_handler.go
index 1a7b597d..a3d8a1d5 100644
--- a/backend/pkg/handlers/policies_handler.go
+++ b/backend/pkg/handlers/policies_handler.go
@@ -10,9 +10,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // UpdatePolicyRequest carries the full replacement policy as JSON.
diff --git a/backend/pkg/handlers/policies_handler_test.go b/backend/pkg/handlers/policies_handler_test.go
index 5e9f513e..9b33b07a 100644
--- a/backend/pkg/handlers/policies_handler_test.go
+++ b/backend/pkg/handlers/policies_handler_test.go
@@ -10,9 +10,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	sdktypes "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func policyStatusVersion(opts []openshell.GetStatusOption) uint32 {
diff --git a/backend/pkg/handlers/policies_revisions_handler_test.go b/backend/pkg/handlers/policies_revisions_handler_test.go
index ffaf9dc5..23463d93 100644
--- a/backend/pkg/handlers/policies_revisions_handler_test.go
+++ b/backend/pkg/handlers/policies_revisions_handler_test.go
@@ -11,11 +11,11 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	sdktypes "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // policyRoutes mounts every policy route on the paths app.go gives them.
diff --git a/backend/pkg/handlers/provider_profiles_handler.go b/backend/pkg/handlers/provider_profiles_handler.go
index 0d8c3177..54d2b435 100644
--- a/backend/pkg/handlers/provider_profiles_handler.go
+++ b/backend/pkg/handlers/provider_profiles_handler.go
@@ -9,8 +9,8 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // The provider profile routes, which ProvidersHandler serves in two scopes.
diff --git a/backend/pkg/handlers/provider_profiles_handler_test.go b/backend/pkg/handlers/provider_profiles_handler_test.go
index d1cb46cf..644d162f 100644
--- a/backend/pkg/handlers/provider_profiles_handler_test.go
+++ b/backend/pkg/handlers/provider_profiles_handler_test.go
@@ -12,10 +12,10 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	pb "github.com/NVIDIA/OpenShell/sdk/go/proto/openshellv1"
 	sbv1 "github.com/NVIDIA/OpenShell/sdk/go/proto/sandboxv1"
+	"github.com/ai-openshell/console/backend/pkg/services"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/encoding/protojson"
diff --git a/backend/pkg/handlers/providers_handler.go b/backend/pkg/handlers/providers_handler.go
index 94919d18..3eaf1bc2 100644
--- a/backend/pkg/handlers/providers_handler.go
+++ b/backend/pkg/handlers/providers_handler.go
@@ -7,9 +7,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 var refreshStrategyMap = map[string]openshell.RefreshStrategy{
diff --git a/backend/pkg/handlers/providers_handler_test.go b/backend/pkg/handlers/providers_handler_test.go
index 15a2337e..1165a8f0 100644
--- a/backend/pkg/handlers/providers_handler_test.go
+++ b/backend/pkg/handlers/providers_handler_test.go
@@ -12,9 +12,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
+	"github.com/ai-openshell/console/backend/pkg/services"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/backend/pkg/handlers/sandboxes_handler.go b/backend/pkg/handlers/sandboxes_handler.go
index a010961f..c430e35b 100644
--- a/backend/pkg/handlers/sandboxes_handler.go
+++ b/backend/pkg/handlers/sandboxes_handler.go
@@ -5,9 +5,9 @@ import (
 	"log/slog"
 	"net/http"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 type SandboxHandler struct {
diff --git a/backend/pkg/handlers/sandboxes_handler_test.go b/backend/pkg/handlers/sandboxes_handler_test.go
index 1d957dc7..70c12c1d 100644
--- a/backend/pkg/handlers/sandboxes_handler_test.go
+++ b/backend/pkg/handlers/sandboxes_handler_test.go
@@ -12,9 +12,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestListSandboxes(t *testing.T) {
diff --git a/backend/pkg/handlers/services_handler.go b/backend/pkg/handlers/services_handler.go
index 9549d837..526763da 100644
--- a/backend/pkg/handlers/services_handler.go
+++ b/backend/pkg/handlers/services_handler.go
@@ -3,9 +3,9 @@ package handlers
 import (
 	"net/http"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // ExposeServiceRequest is the expose-service body. Service may be empty: a
diff --git a/backend/pkg/handlers/settings_handler.go b/backend/pkg/handlers/settings_handler.go
index 61b29688..9e7bdfe2 100644
--- a/backend/pkg/handlers/settings_handler.go
+++ b/backend/pkg/handlers/settings_handler.go
@@ -6,9 +6,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 type SettingsHandler struct {
diff --git a/backend/pkg/handlers/templates_handler.go b/backend/pkg/handlers/templates_handler.go
index e031d299..c59d8da3 100644
--- a/backend/pkg/handlers/templates_handler.go
+++ b/backend/pkg/handlers/templates_handler.go
@@ -6,9 +6,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 type TemplatesHandler struct {
diff --git a/backend/pkg/handlers/templates_handler_test.go b/backend/pkg/handlers/templates_handler_test.go
index 5ce7b828..c0f589ff 100644
--- a/backend/pkg/handlers/templates_handler_test.go
+++ b/backend/pkg/handlers/templates_handler_test.go
@@ -14,8 +14,8 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestListSandboxTemplates(t *testing.T) {
diff --git a/backend/pkg/handlers/terminal_handler.go b/backend/pkg/handlers/terminal_handler.go
index 3e3466a8..950a77de 100644
--- a/backend/pkg/handlers/terminal_handler.go
+++ b/backend/pkg/handlers/terminal_handler.go
@@ -16,7 +16,7 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 const (
diff --git a/backend/pkg/handlers/workspaces_handler.go b/backend/pkg/handlers/workspaces_handler.go
index 967fe733..bc646006 100644
--- a/backend/pkg/handlers/workspaces_handler.go
+++ b/backend/pkg/handlers/workspaces_handler.go
@@ -4,9 +4,9 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // CreateWorkspaceRequest is the create-workspace body.
diff --git a/backend/pkg/server/allworkspaces_routes_test.go b/backend/pkg/server/allworkspaces_routes_test.go
index 2b3b4279..e8885449 100644
--- a/backend/pkg/server/allworkspaces_routes_test.go
+++ b/backend/pkg/server/allworkspaces_routes_test.go
@@ -12,8 +12,8 @@ import (
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/fake"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // withServices is an SDK client whose service endpoints come from a fixed
diff --git a/backend/pkg/server/app.go b/backend/pkg/server/app.go
index 7ab9db08..4c5aa63c 100644
--- a/backend/pkg/server/app.go
+++ b/backend/pkg/server/app.go
@@ -12,12 +12,12 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/clients"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/handlers"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/clients"
+	"github.com/ai-openshell/console/backend/pkg/handlers"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // App wires the OpenShell SDK client, auth middleware, and REST routes.
diff --git a/backend/pkg/server/draft_summary_routes_test.go b/backend/pkg/server/draft_summary_routes_test.go
index e1bd5f57..3768ef01 100644
--- a/backend/pkg/server/draft_summary_routes_test.go
+++ b/backend/pkg/server/draft_summary_routes_test.go
@@ -12,8 +12,8 @@ import (
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/fake"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // withDrafts is an SDK client whose draft inboxes come from a fixed table
diff --git a/backend/pkg/server/extensions_test.go b/backend/pkg/server/extensions_test.go
index 28be5e80..a538bf0b 100644
--- a/backend/pkg/server/extensions_test.go
+++ b/backend/pkg/server/extensions_test.go
@@ -7,8 +7,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/handlers"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/handlers"
 )
 
 func testApp(extensions ...Extension) *App {
diff --git a/backend/pkg/server/gateway_release_line_test.go b/backend/pkg/server/gateway_release_line_test.go
index 3373a2c3..b559498f 100644
--- a/backend/pkg/server/gateway_release_line_test.go
+++ b/backend/pkg/server/gateway_release_line_test.go
@@ -11,8 +11,8 @@ import (
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/fake"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // getGateway drives GET /api/v1/gateway through the real router of an App
diff --git a/backend/pkg/server/policy_routes_test.go b/backend/pkg/server/policy_routes_test.go
index 1d94849a..158d8d02 100644
--- a/backend/pkg/server/policy_routes_test.go
+++ b/backend/pkg/server/policy_routes_test.go
@@ -9,9 +9,9 @@ import (
 
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/fake"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // The policy routes exist only if app.go mounts them. Each request here is one
diff --git a/backend/pkg/server/provider_profiles_test.go b/backend/pkg/server/provider_profiles_test.go
index dc53d919..0dd8904d 100644
--- a/backend/pkg/server/provider_profiles_test.go
+++ b/backend/pkg/server/provider_profiles_test.go
@@ -11,8 +11,8 @@ import (
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/fake"
 	pb "github.com/NVIDIA/OpenShell/sdk/go/proto/openshellv1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // scopeRecorder is a profile store that notes the scope of every call.
diff --git a/backend/pkg/server/sandbox_settings_test.go b/backend/pkg/server/sandbox_settings_test.go
index 04c27de7..3ea4a1d5 100644
--- a/backend/pkg/server/sandbox_settings_test.go
+++ b/backend/pkg/server/sandbox_settings_test.go
@@ -11,8 +11,8 @@ import (
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/fake"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // recordingConfig is an SDK client whose config calls are recorded and
diff --git a/backend/pkg/services/gateway.go b/backend/pkg/services/gateway.go
index 23ba1809..f9f05dfb 100644
--- a/backend/pkg/services/gateway.go
+++ b/backend/pkg/services/gateway.go
@@ -6,8 +6,8 @@ package services
 import (
 	"context"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // GatewayServiceInterface is what GatewayHandler depends on. GatewayService
diff --git a/backend/pkg/services/provider_profile.go b/backend/pkg/services/provider_profile.go
index 1437fbc9..8a10a8a4 100644
--- a/backend/pkg/services/provider_profile.go
+++ b/backend/pkg/services/provider_profile.go
@@ -6,7 +6,7 @@ import (
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	pb "github.com/NVIDIA/OpenShell/sdk/go/proto/openshellv1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // ProviderProfileStore reads and writes provider profiles as the gateway's own
diff --git a/backend/pkg/services/provider_profile_test.go b/backend/pkg/services/provider_profile_test.go
index cbd6dc89..26fd987a 100644
--- a/backend/pkg/services/provider_profile_test.go
+++ b/backend/pkg/services/provider_profile_test.go
@@ -11,7 +11,7 @@ import (
 	sbv1 "github.com/NVIDIA/OpenShell/sdk/go/proto/sandboxv1"
 	"google.golang.org/protobuf/proto"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // fakeSDKProfiles is the SDK's profile client over what it was last given.
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index 9a278c0c..dd15a82b 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -58,7 +58,7 @@ EXPOSE 8080
 # Kept at the end of the stage so that changing them rebuilds nothing above.
 ARG GATEWAY_RELEASE_LINE=""
 ARG OPENSHELL_SDK_VERSION=""
-LABEL io.github.gkrumbach07.openshell-dashboard.gateway.line="${GATEWAY_RELEASE_LINE}" \
-      io.github.gkrumbach07.openshell-dashboard.sdk="${OPENSHELL_SDK_VERSION}"
+LABEL io.github.ai-openshell.console.gateway.line="${GATEWAY_RELEASE_LINE}" \
+      io.github.ai-openshell.console.sdk="${OPENSHELL_SDK_VERSION}"
 
 ENTRYPOINT ["/usr/local/bin/openshell-dashboard"]
diff --git a/deploy/ci/upstream/tests/test_publish.py b/deploy/ci/upstream/tests/test_publish.py
index 735161af..60fbcbe0 100644
--- a/deploy/ci/upstream/tests/test_publish.py
+++ b/deploy/ci/upstream/tests/test_publish.py
@@ -9,7 +9,7 @@
 MAIN = "a" * 40
 OLD = "b" * 40
 NEW = "c" * 40
-REPO_URL = "https://github.com/Gkrumbach07/openshell-dashboard"
+REPO_URL = "https://github.com/ai-openshell/console"
 
 
 def plan_for(target, pinned="0.1.3"):
diff --git a/deploy/ci/upstream/tests/test_report.py b/deploy/ci/upstream/tests/test_report.py
index 9082e0ad..1724a05b 100644
--- a/deploy/ci/upstream/tests/test_report.py
+++ b/deploy/ci/upstream/tests/test_report.py
@@ -8,7 +8,7 @@
 import report
 from tests import support
 
-REPO_URL = "https://github.com/Gkrumbach07/openshell-dashboard"
+REPO_URL = "https://github.com/ai-openshell/console"
 RUN_URL = REPO_URL + "/actions/runs/42"
 
 
diff --git a/deploy/helm/openshell-dashboard/README.md b/deploy/helm/openshell-dashboard/README.md
index 43ba0f03..91c4937b 100644
--- a/deploy/helm/openshell-dashboard/README.md
+++ b/deploy/helm/openshell-dashboard/README.md
@@ -124,8 +124,8 @@ These files are in the repository, not in the packaged chart. CI renders each on
 | autoscaling.targetMemoryUtilizationPercentage | string | `nil` | Memory target utilization (null to disable). |
 | dashboard.image.digest | string | `""` | Dashboard image digest; takes precedence over tag. |
 | dashboard.image.pullPolicy | string | `nil` | Dashboard pull policy; null uses global.image.pullPolicy. |
-| dashboard.image.registry | string | `""` | Dashboard image registry; empty uses global.image.registry. |
-| dashboard.image.repository | string | `"gkrumbach07/openshell-dashboard"` | Dashboard image repository. |
+| dashboard.image.registry | string | `"ghcr.io"` | Dashboard image registry; empty uses global.image.registry. |
+| dashboard.image.repository | string | `"ai-openshell/console"` | Dashboard image repository. |
 | dashboard.image.tag | string | `""` | Dashboard image tag; empty uses global.image.tag then Chart.appVersion. |
 | dashboard.logoutURL | string | `"/oauth2/sign_out?rd=/oauth2/sign_in"` | Browser-facing sign-out URL; rd returns to oauth2-proxy sign-in after clearing the session. |
 | dashboard.port | int | `8080` | Dashboard container port (loopback only; never exposed via Service). |
diff --git a/deploy/helm/openshell-dashboard/tests/images_test.yaml b/deploy/helm/openshell-dashboard/tests/images_test.yaml
index f5766927..236f6138 100644
--- a/deploy/helm/openshell-dashboard/tests/images_test.yaml
+++ b/deploy/helm/openshell-dashboard/tests/images_test.yaml
@@ -35,7 +35,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: quay.io/gkrumbach07/openshell-dashboard:test
+          value: ghcr.io/ai-openshell/console:test
       - equal:
           path: spec.template.spec.containers[1].image
           value: quay.io/oauth2-proxy/oauth2-proxy:test
@@ -46,7 +46,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: quay.io/gkrumbach07/openshell-dashboard:1.2
+          value: ghcr.io/ai-openshell/console:1.2
   - it: OpenShift SCC leaves UID and group to the namespace
     template: templates/deployment.yaml
     set:
diff --git a/deploy/helm/openshell-dashboard/values.yaml b/deploy/helm/openshell-dashboard/values.yaml
index 89120656..9a84d0cd 100644
--- a/deploy/helm/openshell-dashboard/values.yaml
+++ b/deploy/helm/openshell-dashboard/values.yaml
@@ -16,9 +16,9 @@ global:
 dashboard:
   image:
     # -- Dashboard image registry; empty uses global.image.registry.
-    registry: ""
+    registry: ghcr.io
     # -- Dashboard image repository.
-    repository: gkrumbach07/openshell-dashboard
+    repository: ai-openshell/console
     # -- Dashboard image tag; empty uses global.image.tag then Chart.appVersion.
     tag: ""
     # -- Dashboard image digest; takes precedence over tag.
diff --git a/docs/adrs/0001-standalone-application.md b/docs/adrs/0001-standalone-application.md
index eec1b68a..188e046e 100644
--- a/docs/adrs/0001-standalone-application.md
+++ b/docs/adrs/0001-standalone-application.md
@@ -10,7 +10,7 @@ OpenShell Dashboard is a web UI for one OpenShell gateway. The BFF is given one
 ## Decisions
 
 1. **Standalone is the only mode.** The dashboard is an application of its own, with its own address, navigation and sign-in. It is not embedded in another application's UI, not loaded as a remote module and not published as a library.
-2. **One container image holds the whole application.** The Go BFF serves the REST API under `/api/v1` and the built React UI from the same process. The image is `quay.io/gkrumbach07/openshell-dashboard`.
+2. **One container image holds the whole application.** The Go BFF serves the REST API under `/api/v1` and the built React UI from the same process. The image is `ghcr.io/ai-openshell/console`.
 3. **It is installed with the Helm chart in `deploy/helm/openshell-dashboard`,** published as an OCI chart at `oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard`. The chart runs the BFF with oauth2-proxy beside it in one pod ([ADR 0002](0002-auth-relay-only-bff.md)) and exposes the proxy through a Gateway API HTTPRoute or an OpenShift Route.
 4. **The BFF never does the following.** It does not terminate authentication, validate tokens or authorize (ADR 0002). It does not call the Kubernetes API. It does not fetch, store or inject provider credentials: they pass through to the gateway and only their names come back. It does not rate-limit. It holds no state: no session store, no database, nothing that ties a request to a replica.
 5. **Nothing is published to npm.** `frontend/package.json` is `private`, and the UI is built only as part of the image.
diff --git a/docs/compatibility.md b/docs/compatibility.md
index f4859e43..a5d80dfd 100644
--- a/docs/compatibility.md
+++ b/docs/compatibility.md
@@ -6,7 +6,7 @@ A dashboard release is for one minor release line of the OpenShell gateway: ever
 
 | Your gateway | Dashboard | Container image |
 |---|---|---|
-| `0.1.x` | `0.1.x` | `quay.io/gkrumbach07/openshell-dashboard:0.1` for the newest release of the line, or an exact `:0.1.N` |
+| `0.1.x` | `0.1.x` | `ghcr.io/ai-openshell/console:0.1` for the newest release of the line, or an exact `:0.1.N`. Releases up to `0.1.3` are at `quay.io/gkrumbach07/openshell-dashboard` |
 | `0.0.116` | the [`gateway-0.0.116`](https://github.com/ai-openshell/console/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` |
 
 `gateway-0.0.116` is a one-off build outside the version numbering, because gateway `0.0.x` releases were not compatible with each other. It has no Templates support (gateway `0.0.116` has no sandbox-template RPCs), and no further release is planned for it.
@@ -30,7 +30,7 @@ The verdict informs and blocks nothing (ADR 0005, decision 9).
 ## Which line a build is for
 
 - **A release**: the first two numbers of its version. `0.1.4` is for gateway `0.1.x`.
-- **A container image**: the label `io.github.gkrumbach07.openshell-dashboard.gateway.line`.
+- **A container image**: the label `io.github.ai-openshell.console.gateway.line`.
 - **A running dashboard**: **Help → About**, under *Built for gateway*. It shows no dashboard version: the image is built before a release is cut.
 
 ## How it is tested
diff --git a/docs/releasing.md b/docs/releasing.md
index 118c9ef5..7906ef43 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -9,10 +9,10 @@ A release `vX.Y.Z` is three things, all made by `publish.yml`:
 | Artifact | Where | Made by |
 |---|---|---|
 | GitHub release `vX.Y.Z`, and the git tag with it | this repository | `scripts/release/cut-release.mjs` |
-| Container image tags `X.Y.Z` and `X.Y` | `quay.io/gkrumbach07/openshell-dashboard` | retagging the image CI already built |
+| Container image tags `X.Y.Z` and `X.Y` | `ghcr.io/ai-openshell/console` | retagging the image CI already built |
 | Helm chart `openshell-dashboard`, version `X.Y.Z` | `oci://ghcr.io/ai-openshell/console/helm-chart` | packaging the chart at the released commit |
 
-The chart's registry path follows the repository's name (`publish.yml` pushes to `oci://ghcr.io/<owner>/<repository>/helm-chart`), so a package created under a new name starts out private: make it public in the organization's package settings before announcing the release. Releases up to `0.1.2` are at `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart`, the path before the repository moved to `ai-openshell/console`; nothing is published there any more.
+The chart's registry path follows the repository's name (`publish.yml` pushes to `oci://ghcr.io/<owner>/<repository>/helm-chart`), so a package created under a new name starts out private: make it public in the organization's package settings before announcing the release. Releases up to `0.1.2` are at `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart`, the path before the repository moved to `ai-openshell/console`; nothing is published there any more. The image moved the same way: releases up to `0.1.3` are at `quay.io/gkrumbach07/openshell-dashboard`, and CI pushes every newer image to `ghcr.io/ai-openshell/console` with the workflow's own token, so no registry secret is needed. That package also starts out private.
 
 The BFF and the UI ship together and share the version.
 
@@ -125,7 +125,7 @@ The GitHub release and the container image each state the gateway release line t
 | Artifact | What it carries | Written by |
 |---|---|---|
 | GitHub release | a *Supported OpenShell gateways* section: the line, the gateway release it was built on and tested against, the SDK, and a line that changed since the previous release | `scripts/release/release-notes.mjs` |
-| Container image | labels `io.github.gkrumbach07.openshell-dashboard.gateway.line` and `.sdk` | build args in the `build` job of `ci.yml`; `image-range` fails if the pushed image lacks them |
+| Container image | labels `io.github.ai-openshell.console.gateway.line` and `.sdk` | build args in the `build` job of `ci.yml`; `image-range` fails if the pushed image lacks them |
 | README | the generated table under *Compatibility* | `scripts/readme-gateway-range.mjs --write`, checked in CI |
 
 The BFF does not read the labels. Its line is compiled in (`BuiltInGatewayReleaseLine` in [`backend/pkg/models/gateway_release_line.go`](../backend/pkg/models/gateway_release_line.go)), so the compatibility notice also works in an image built without the build args. `node scripts/gateway-range.mjs --check` fails unless that constant and the SDK version in `backend/go.mod` agree with the pins file. The SDK moves with the gateway images in one commit ([ADR 0005](adrs/0005-gateway-compatibility-and-releases.md), decision 7), and so does the constant when the pin moves to a new minor.
diff --git a/frontend/package.json b/frontend/package.json
index 84ea929d..7eba2cad 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -6,7 +6,7 @@
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://github.com/Gkrumbach07/openshell-dashboard"
+    "url": "https://github.com/ai-openshell/console"
   },
   "scripts": {
     "start": "vite",
diff --git a/scripts/check-image-range.mjs b/scripts/check-image-range.mjs
index a591b156..b839a972 100755
--- a/scripts/check-image-range.mjs
+++ b/scripts/check-image-range.mjs
@@ -3,7 +3,7 @@
 // line it is for and the SDK it was built against, on every platform it was
 // built for.
 //
-//   node scripts/check-image-range.mjs quay.io/gkrumbach07/openshell-dashboard:sha-0a1b2c3
+//   node scripts/check-image-range.mjs ghcr.io/ai-openshell/console:sha-0a1b2c3
 //
 // Both reach the image as build args: ci.yml passes them, and deploy/Dockerfile
 // turns them into two labels. A build arg that is misspelt on either side is
@@ -23,7 +23,7 @@ import { fileURLToPath } from 'node:url';
 import { readGatewayLine } from './gateway-range.mjs';
 
 // Must match the LABEL keys in deploy/Dockerfile.
-export const LABEL_PREFIX = 'io.github.gkrumbach07.openshell-dashboard';
+export const LABEL_PREFIX = 'io.github.ai-openshell.console';
 
 /** The labels deploy/Dockerfile should have baked in for this build. */
 export function expectedLabels(declared) {
diff --git a/scripts/release/next-merge.test.mjs b/scripts/release/next-merge.test.mjs
index c9f15eb0..fcbbd7d5 100644
--- a/scripts/release/next-merge.test.mjs
+++ b/scripts/release/next-merge.test.mjs
@@ -18,7 +18,7 @@ const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
 // ---- which commit may release without being asked ---------------------------
 
-const REPO = 'Gkrumbach07/openshell-dashboard';
+const REPO = 'ai-openshell/console';
 const pull = (overrides = {}) => ({
   merged_at: '2026-10-14T06:30:00Z',
   base: { ref: 'main' },
diff --git a/scripts/release/publish-workflow.test.mjs b/scripts/release/publish-workflow.test.mjs
index 6948af80..f2749e6b 100644
--- a/scripts/release/publish-workflow.test.mjs
+++ b/scripts/release/publish-workflow.test.mjs
@@ -16,7 +16,7 @@ import { fileURLToPath } from 'node:url';
 
 const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
 const workflow = readFileSync(join(repoRoot, '.github', 'workflows', 'publish.yml'), 'utf8');
-const REPO = 'Gkrumbach07/openshell-dashboard';
+const REPO = 'ai-openshell/console';
 const haveBash = spawnSync('bash', ['--version'], { stdio: 'ignore' }).status === 0;
 
 /** The shell of the step with this name, as the runner would run it. */
diff --git a/scripts/retag-image.sh b/scripts/retag-image.sh
index b92ae9df..44155a59 100755
--- a/scripts/retag-image.sh
+++ b/scripts/retag-image.sh
@@ -2,7 +2,7 @@
 # Give an image that is already in the registry more tags, without rebuilding.
 #
 #   scripts/retag-image.sh IMAGE SOURCE_TAG NEW_TAG [NEW_TAG...]
-#   scripts/retag-image.sh quay.io/gkrumbach07/openshell-dashboard sha-0a1b2c3 0.1.4 0.1
+#   scripts/retag-image.sh ghcr.io/ai-openshell/console sha-0a1b2c3 0.1.4 0.1
 #
 # CI builds one image per commit and tags it sha-<commit>. Every other tag is a
 # statement about that same image, made later by something that knows more: