diff --git a/.github/workflows/prof_asan.yml b/.github/workflows/prof_asan.yml
index f936cb9831a..46c8fe591e3 100644
--- a/.github/workflows/prof_asan.yml
+++ b/.github/workflows/prof_asan.yml
@@ -21,7 +21,7 @@ jobs:
       CARGO_TARGET_DIR: /tmp/build-cargo
       RUST_TOOLCHAIN: nightly-2025-06-13
     container:
-      image: datadog/dd-trace-ci:php-${{matrix.php-version}}_bookworm-8
+      image: datadog/dd-trace-ci:php-${{matrix.php-version}}_bookworm-9
       # https://docs.github.com/en/actions/creating-actions/dockerfile-support-for-github-actions#user
       options: --user root
 
@@ -86,7 +86,7 @@ jobs:
       CARGO_TARGET_DIR: /tmp/build-cargo
       UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
     container:
-      image: datadog/dd-trace-ci:php-8.5_bookworm-8
+      image: datadog/dd-trace-ci:php-8.5_bookworm-9
       options: --user root
 
     steps:
@@ -127,25 +127,6 @@ jobs:
           cargo build --profile profiler-release
           cp -v "$CARGO_TARGET_DIR/profiler-release/libdatadog_php_profiling.so" "$(php-config --extension-dir)/datadog-profiling.so"
 
-      # TODO(parallel): the php-8.5_bookworm-8 image ships parallel 1.2.13, which
-      # has a bug that intermittently trips UBSAN. Install the fixed 1.2.14 over
-      # it (ZTS-only; parallel requires ZTS). Remove this step once the CI images
-      # are rebuilt with parallel >= 1.2.14.
-      - name: Install fixed parallel 1.2.14 (ZTS only, temporary until images rebuilt)
-        if: matrix.php-build == 'zts'
-        run: |
-          set -eux
-          switch-php zts
-          scan_dir="$(php -r 'echo PHP_CONFIG_FILE_SCAN_DIR;')"
-          # pecl refuses to reinstall while the extension is loaded, so move its
-          # ini aside during the build, then restore it so the test run loads the
-          # freshly installed parallel.so. Use the direct package URL because the
-          # channel REST cache in the image can lag behind new releases.
-          mv "$scan_dir/parallel.ini" /tmp/parallel.ini.disabled
-          yes '' | pecl install -f https://pecl.php.net/get/parallel-1.2.14.tgz
-          mv /tmp/parallel.ini.disabled "$scan_dir/parallel.ini"
-          php --ri parallel | grep -i version
-
       - name: Run phpt tests
         run: |
           set -eux
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b7d512b1dc1..f3c306a2586 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,6 +3,7 @@ stages:
   - tests
   - deploy
   - ci-build
+  - ci-publish
 
 variables:
   GIT_SUBMODULE_STRATEGY: recursive
@@ -17,7 +18,6 @@ include:
   - project: DataDog/apm-reliability/libdatadog-build
     ref: 5826819695d93286569e70ed087ae6bf906ce2c3
     file: templates/ci_authenticated_job.yml
-  - local: .gitlab/ci-images.yml
 
 generate-templates:
   stage: build
@@ -56,6 +56,7 @@ generate-templates:
     - php ./.gitlab/generate-appsec.php   | tee .gitlab/appsec-gen.yml
     - php ./.gitlab/generate-profiler.php | tee .gitlab/profiler-gen.yml
     - php ./.gitlab/generate-shared.php   | tee .gitlab/shared-gen.yml
+    - php ./.gitlab/generate-ci-images.php | tee .gitlab/ci-images-gen.yml
   variables:
     GIT_SUBMODULE_STRATEGY: none
   artifacts:
@@ -89,6 +90,22 @@ appsec-trigger:
     PARENT_PIPELINE_ID: $CI_PIPELINE_ID
     GIT_SUBMODULE_PATHS: libdatadog appsec/third_party/cpp-base64 appsec/third_party/libddwaf appsec/third_party/libddwaf-rust appsec/third_party/msgpack-c
 
+# Manual maintenance pipeline that (re)builds the CI Docker images. Generated
+# from dockerfiles/ci/*/docker-compose.yml + .env so versions live in one place.
+# No strategy: depend — the parent must not wait on these manual jobs.
+ci-images:
+  stage: ci-build
+  rules:
+    - when: manual
+      allow_failure: true
+  needs:
+    - job: generate-templates
+      artifacts: true
+  trigger:
+    include:
+      - artifact: .gitlab/ci-images-gen.yml
+        job: generate-templates
+
 profiler-trigger:
   stage: tests
   needs: [ "generate-templates" ]
diff --git a/.gitlab/ci-images.yml b/.gitlab/ci-images.yml
deleted file mode 100644
index c2b725f7d44..00000000000
--- a/.gitlab/ci-images.yml
+++ /dev/null
@@ -1,214 +0,0 @@
-variables:
-  CI_REGISTRY_USER:
-    value: ""
-    description: "Your docker hub username"
-  CI_REGISTRY_TOKEN:
-    value: ""
-    description: "Your docker hub personal access token, can be created following this doc https://docs.docker.com/docker-hub/access-tokens/#create-an-access-token"
-  CI_REGISTRY:
-    value: "docker.io"
-
-CentOS:
-  stage: ci-build
-  rules:
-    - when: manual
-      allow_failure: true
-  needs: []
-  tags: ["arch:amd64"]
-  timeout: 4h
-  image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:29.4.0-noble
-  variables:
-    DDCI_CONFIGURE_OTEL_EXPORTER: "true"
-  parallel:
-    matrix:
-      - PHP_VERSION:
-        - base
-        - php-8.5
-        - php-8.4
-        - php-8.3
-        - php-8.2
-        - php-8.1
-        - php-8.0
-        - php-7.4
-        - php-7.3
-        - php-7.2
-        - php-7.1
-        - php-7.0
-  script:
-    - cd dockerfiles/ci/centos/7
-    - echo "$CI_REGISTRY_TOKEN" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
-    - docker buildx bake --no-cache --pull --push $PHP_VERSION
-
-Alpine:
-  stage: ci-build
-  rules:
-    - when: manual
-      allow_failure: true
-  needs: []
-  tags: ["arch:amd64"]
-  timeout: 4h
-  image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:29.4.0-noble
-  variables:
-    DDCI_CONFIGURE_OTEL_EXPORTER: "true"
-  parallel:
-    matrix:
-      - PHP_VERSION:
-        - base-alpine
-        - 8.5-alpine
-        - 8.4-alpine
-        - 8.3-alpine
-        - 8.2-alpine
-        - 8.1-alpine
-        - 8.0-alpine
-        - 7.4-alpine
-        - 7.3-alpine
-        - 7.2-alpine
-        - 7.1-alpine
-        - 7.0-alpine
-  script:
-    - cd dockerfiles/ci/alpine_compile_extension
-    - echo "$CI_REGISTRY_TOKEN" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
-    - docker buildx bake --no-cache --pull --push $PHP_VERSION
-
-Bookworm:
-  stage: ci-build
-  rules:
-    - when: manual
-      allow_failure: true
-  needs: []
-  tags: ["arch:amd64"]
-  timeout: 4h
-  image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:29.4.0-noble
-  variables:
-    DDCI_CONFIGURE_OTEL_EXPORTER: "true"
-  parallel:
-    matrix:
-      - PHP_VERSION:
-        - base
-      - PHP_VERSION:
-        - php-8.5
-        - php-8.4
-        - php-8.3
-        - php-8.2
-        - php-8.1
-        - php-8.0
-        - php-8.0-shared-ext
-        - php-7.4
-        - php-7.4-shared-ext
-        - php-7.3
-        - php-7.2
-        - php-7.1
-        - php-7.0
-        MAKE_JOBS: ["2"]
-  script:
-    - cd dockerfiles/ci/bookworm
-    - echo "$CI_REGISTRY_TOKEN" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
-    - docker buildx bake --no-cache --pull --push $PHP_VERSION
-
-.windows_image_build:
-  stage: ci-build
-  rules:
-    - when: manual
-      allow_failure: true
-  needs: []
-  tags: ["windows-v2:2019"]
-  timeout: 6h
-  variables:
-    DDCI_CONFIGURE_OTEL_EXPORTER: "true"
-    GIT_STRATEGY: none
-  script: |
-    # Kill leftover containers; a previous run may still hold php_ddtrace.dll open.
-    $containers = docker ps -aq 2>$null
-    if ($containers) { docker rm -f $containers 2>$null }
-
-    # Use cmd.exe rd from the parent dir: handles junctions/symlinks that PS5.1 Remove-Item cannot.
-    Write-Host "Performing workspace cleanup..."
-    $workspace = $PWD.Path
-    Push-Location ..
-    cmd /c "rd /s /q ""$workspace"""
-    if (-not (Test-Path $workspace)) {
-        New-Item -ItemType Directory -Path $workspace -Force | Out-Null
-    }
-    Pop-Location
-    $remaining = Get-ChildItem -Path . -Force -ErrorAction SilentlyContinue
-    if ($remaining) { Write-Host "WARNING: could not remove: $($remaining.Name -join ', ')" }
-    Write-Host "Cleanup complete."
-
-    # PS 5.1 ignores $PSNativeCommandUseErrorActionPreference; use $LASTEXITCODE checks instead.
-    $ErrorActionPreference = 'Stop'
-
-    # Manual git clone with proper config.
-    Write-Host "Cloning repository..."
-    git config --global core.longpaths true
-    git config --global core.symlinks true
-    git clone --branch $env:CI_COMMIT_REF_NAME $env:CI_REPOSITORY_URL .
-    if ($LASTEXITCODE -ne 0) {
-        Write-Host "ERROR: git clone failed. Remaining workspace contents:"
-        Get-ChildItem -Force | Select-Object Name
-        exit $LASTEXITCODE
-    }
-    git checkout $env:CI_COMMIT_SHA
-    if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-    # Initialize submodules.
-    Write-Host "Initializing submodules..."
-    git submodule update --init --recursive
-    if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-    Write-Host "Git setup complete."
-
-    # Download docker-compose to the workspace.
-    Write-Host "Downloading docker-compose..."
-    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-    $dockerCompose = "$PWD\docker-compose.exe"
-    Start-BitsTransfer -Source "https://github.com/docker/compose/releases/download/v2.36.0/docker-compose-windows-x86_64.exe" -Destination $dockerCompose
-
-    cd dockerfiles\ci\windows
-
-    $env:DOCKER_CONFIG = Join-Path $env:CI_PROJECT_DIR ".docker"
-    New-Item -ItemType Directory -Force -Path $env:DOCKER_CONFIG | Out-Null
-    Set-Content -Encoding ascii -Path (Join-Path $env:DOCKER_CONFIG "config.json") -Value '{"auths":{}}'
-
-    $env:CI_REGISTRY_TOKEN | docker login -u "$env:CI_REGISTRY_USER" --password-stdin "$env:CI_REGISTRY"
-    if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-    docker version
-    if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-    & $dockerCompose version
-    if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-    foreach ($target in ($env:WINDOWS_IMAGE_TARGETS -split ' ')) {
-      if ([string]::IsNullOrWhiteSpace($target)) { continue }
-
-      Write-Host "Building Windows CI image target $target..."
-      & $dockerCompose build --pull --no-cache $target
-      if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-      Write-Host "Pushing Windows CI image target $target..."
-      & $dockerCompose push $target
-      if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-    }
-
-"Windows 1: Tool Images":
-  extends: .windows_image_build
-  parallel:
-    matrix:
-      - WINDOWS_IMAGE_TARGETS:
-        - "vc15"
-        - "vs16"
-        - "vs17"
-
-"Windows 2: PHP Images":
-  extends: .windows_image_build
-  parallel:
-    matrix:
-      - WINDOWS_IMAGE_TARGETS:
-        - "php-8.5"
-        - "php-8.4"
-        - "php-8.3"
-        - "php-8.2"
-        - "php-8.1"
-        - "php-8.0"
-        - "php-7.4"
-        - "php-7.3"
-        - "php-7.2"
diff --git a/.gitlab/generate-appsec.php b/.gitlab/generate-appsec.php
index 81f4df374c3..43dbddd6020 100644
--- a/.gitlab/generate-appsec.php
+++ b/.gitlab/generate-appsec.php
@@ -71,7 +71,7 @@
 "test appsec extension":
   stage: test
   extends: .appsec_test
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-9
   variables:
     KUBERNETES_CPU_REQUEST: 3
     KUBERNETES_CPU_LIMIT: 3
@@ -393,7 +393,7 @@
 "appsec code coverage":
   stage: test
   extends: .appsec_test
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-8.3_bookworm-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-9
   variables:
     KUBERNETES_CPU_REQUEST: 3
     KUBERNETES_MEMORY_REQUEST: 3Gi
@@ -515,7 +515,7 @@
 "appsec lint":
   stage: test
   extends: .appsec_test
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-8.3_bookworm-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-9
   variables:
     KUBERNETES_CPU_REQUEST: 3
     KUBERNETES_MEMORY_REQUEST: 9Gi
@@ -537,7 +537,7 @@
 "test appsec helper asan":
   stage: test
   extends: .appsec_test
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:bookworm-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:bookworm-9
   variables:
     KUBERNETES_CPU_REQUEST: 3
     KUBERNETES_MEMORY_REQUEST: 3Gi
@@ -563,7 +563,7 @@
 #"fuzz appsec helper":
 #  stage: test
 #  extends: .appsec_test
-#  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:bookworm-8
+#  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:bookworm-9
 #  variables:
 #    KUBERNETES_CPU_REQUEST: 3
 #    KUBERNETES_MEMORY_REQUEST: 5Gi
diff --git a/.gitlab/generate-ci-images.php b/.gitlab/generate-ci-images.php
new file mode 100644
index 00000000000..8c72ed8ee7f
--- /dev/null
+++ b/.gitlab/generate-ci-images.php
@@ -0,0 +1,280 @@
+<?php
+
+/**
+ * Generates the CI image build + publish GitLab child pipeline.
+ *
+ * Source of truth (NO duplication):
+ *   - dockerfiles/ci/<os>/docker-compose.yml : service name -> image:TAG
+ *   - dockerfiles/ci/bookworm/.env           : $BOOKWORM_NEXT_VERSION etc.
+ *
+ * The compose service name is the `docker buildx bake` target and the build
+ * matrix value; the `image:` tag (with env vars resolved) is the published tag.
+ * This script prints a literal preamble (stages, job templates), then loops
+ * over the parsed compose services to emit, per Linux OS, one build matrix job
+ * over PHP versions (bake builds and pushes the multi-arch image) plus a manual
+ * publish matrix job that mirrors the tags to Docker Hub. Windows is emitted the
+ * same way but single-arch (no manifest) with its own build runner/script.
+ */
+
+$root = dirname(__DIR__);
+
+// Resolve $VAR / ${VAR} from a key=value .env file.
+function parse_env(string $path): array
+{
+    $env = [];
+    foreach (@file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [] as $line) {
+        if (preg_match('/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/', $line, $m)) {
+            $env[$m[1]] = $m[2];
+        }
+    }
+    return $env;
+}
+
+function substitute(string $s, array $env): string
+{
+    return preg_replace_callback('/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/', function ($m) use ($env) {
+        return $env[$m[1]] ?? $m[0];
+    }, $s);
+}
+
+// Parse a docker-compose.yml into [service => tag], preserving file order.
+function parse_compose(string $path, array $env): array
+{
+    $services = [];
+    $cur = null;
+    $inServices = false;
+    foreach (file($path, FILE_IGNORE_NEW_LINES) as $line) {
+        if (preg_match('/^services:\s*$/', $line)) {
+            $inServices = true;
+            continue;
+        }
+        if (!$inServices) {
+            continue;
+        }
+        if (preg_match('/^\S/', $line)) { // back to a top-level key
+            $inServices = false;
+            continue;
+        }
+        if (preg_match('/^  ([A-Za-z0-9][A-Za-z0-9._-]*):\s*$/', $line, $m)) {
+            $cur = $m[1];
+            $services[$cur] = null;
+            continue;
+        }
+        // image: ${CI_REGISTRY_IMAGE:-...}:TAG   (first image: wins per service)
+        if ($cur !== null && $services[$cur] === null
+            && preg_match('/^    image:\s*[\'"]?\$\{[^}]+\}:([^\s\'"]+)/', $line, $m)) {
+            $services[$cur] = substitute($m[1], $env);
+        }
+    }
+    return array_filter($services, fn($v) => $v !== null);
+}
+
+$dirs = [
+    "Bookworm" => "dockerfiles/ci/bookworm",
+    "CentOS"   => "dockerfiles/ci/centos/7",
+    "Alpine"   => "dockerfiles/ci/alpine_compile_extension",
+];
+
+$osList = [];
+foreach ($dirs as $os => $dir) {
+    $services = parse_compose("$root/$dir/docker-compose.yml", parse_env("$root/$dir/.env"));
+    if (!$services) {
+        fwrite(STDERR, "WARNING: no services parsed for $os ($dir)\n");
+        continue;
+    }
+    $osList[] = ["name" => $os, "dir" => $dir, "services" => $services];
+}
+
+// Windows is single-arch (no multi-arch manifest) and uses a different build
+// runner/script, so it is emitted separately from the Linux loop below. It has
+// no .env, so tags resolve with an empty env map.
+$winServices = parse_compose("$root/dockerfiles/ci/windows/docker-compose.yml", []);
+if (!$winServices) {
+    fwrite(STDERR, "WARNING: no services parsed for Windows\n");
+}
+?>
+# CI image build + publish child pipeline, generated by
+# .gitlab/generate-ci-images.php from the docker-compose.yml + .env files.
+# Edit the generator, never this generated file. Windows is generated too
+# (single-arch, no multi-arch manifest, different build runner/script).
+
+stages:
+  - ci-build
+  - ci-publish
+
+variables:
+  CI_REGISTRY_IMAGE: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci"
+
+.linux_image_build:
+  stage: ci-build
+  rules:
+    - when: manual
+      allow_failure: true
+  needs: []
+  timeout: 4h
+  image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:29.4.0-noble
+  variables:
+    DDCI_CONFIGURE_OTEL_EXPORTER: "true"
+    # Compile runs on the buildx "ci" builder instance, not this job pod, so the
+    # pod uses cluster defaults. MAKE_JOBS sets the builder's compile parallelism.
+    MAKE_JOBS: "8"
+
+.image_publish:
+  stage: ci-publish
+  rules:
+    - when: manual
+      allow_failure: true
+  # No deps: a publish just mirrors whatever already exists in
+  # registry.ddbuild.io to Docker Hub, so it can run without (re)building.
+  needs: []
+  trigger:
+    project: DataDog/public-images
+    branch: main
+  # $TAG is supplied per matrix entry by the generated publish jobs.
+  variables:
+    IMG_REGISTRIES: "dockerhub"
+    IMG_SIGNING: false
+    IMG_SOURCES: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:${TAG}"
+    IMG_DESTINATIONS: "dd-trace-ci:${TAG}"
+
+.windows_image_build:
+  stage: ci-build
+  rules:
+    - when: manual
+      allow_failure: true
+  needs: []
+  tags: ["windows-v2:2019"]
+  timeout: 6h
+  # CI Identities auth for pushing to registry.ddbuild.io from this non-K8s
+  # (shell) runner. Required for the internal-registry push to work once the
+  # repo is onboarded to CI Identities (see #ci-identities). Until then these
+  # manual jobs won't succeed; the script still needs the
+  # `ci-identities-gitlab-job-client.exe assume-role` + docker-config wiring,
+  # which can only be verified post-onboarding.
+  id_tokens:
+    CI_IDENTITIES_GITLAB_ID_TOKEN:
+      aud: ci-identities
+  variables:
+    DDCI_CONFIGURE_OTEL_EXPORTER: "true"
+    GIT_STRATEGY: none
+  script: |
+    # Kill leftover containers; a previous run may still hold php_ddtrace.dll open.
+    $containers = docker ps -aq 2>$null
+    if ($containers) { docker rm -f $containers 2>$null }
+
+    # Use cmd.exe rd from the parent dir: handles junctions/symlinks that PS5.1 Remove-Item cannot.
+    Write-Host "Performing workspace cleanup..."
+    $workspace = $PWD.Path
+    Push-Location ..
+    cmd /c "rd /s /q ""$workspace"""
+    if (-not (Test-Path $workspace)) {
+        New-Item -ItemType Directory -Path $workspace -Force | Out-Null
+    }
+    Pop-Location
+    $remaining = Get-ChildItem -Path . -Force -ErrorAction SilentlyContinue
+    if ($remaining) { Write-Host "WARNING: could not remove: $($remaining.Name -join ', ')" }
+    Write-Host "Cleanup complete."
+
+    # PS 5.1 ignores $PSNativeCommandUseErrorActionPreference; use $LASTEXITCODE checks instead.
+    $ErrorActionPreference = 'Stop'
+
+    # Manual git clone with proper config.
+    Write-Host "Cloning repository..."
+    git config --global core.longpaths true
+    git config --global core.symlinks true
+    git clone --branch $env:CI_COMMIT_REF_NAME $env:CI_REPOSITORY_URL .
+    if ($LASTEXITCODE -ne 0) {
+        Write-Host "ERROR: git clone failed. Remaining workspace contents:"
+        Get-ChildItem -Force | Select-Object Name
+        exit $LASTEXITCODE
+    }
+    git checkout $env:CI_COMMIT_SHA
+    if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+    # Initialize submodules.
+    Write-Host "Initializing submodules..."
+    git submodule update --init --recursive
+    if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+    Write-Host "Git setup complete."
+
+    # Download docker-compose to the workspace.
+    Write-Host "Downloading docker-compose..."
+    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+    $dockerCompose = "$PWD\docker-compose.exe"
+    Start-BitsTransfer -Source "https://github.com/docker/compose/releases/download/v2.36.0/docker-compose-windows-x86_64.exe" -Destination $dockerCompose
+
+    cd dockerfiles\ci\windows
+
+    docker version
+    if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+    & $dockerCompose version
+    if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+    foreach ($target in ($env:WINDOWS_IMAGE_TARGETS -split ' ')) {
+      if ([string]::IsNullOrWhiteSpace($target)) { continue }
+
+      Write-Host "Building Windows CI image target $target..."
+      & $dockerCompose build --pull --no-cache $target
+      if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      Write-Host "Pushing Windows CI image target $target..."
+      & $dockerCompose push $target
+      if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+    }
+
+<?php /*
+  Windows: single matrix over every compose service (base tools + tools + php).
+  No needs/deps - like the Linux base/php builds, you manually run the base
+  matrix entries before the dependent ones.
+*/ ?>
+Windows build:
+  extends: .windows_image_build
+  parallel:
+    matrix:
+      - WINDOWS_IMAGE_TARGETS:
+<?php foreach (array_keys($winServices) as $svc): ?>
+        - "<?= $svc ?>"
+<?php endforeach; ?>
+
+Windows publish:
+  extends: .image_publish
+  parallel:
+    matrix:
+      - TAG:
+<?php foreach ($winServices as $tag): ?>
+        - "<?= $tag ?>"
+<?php endforeach; ?>
+<?php foreach ($osList as ['name' => $os, 'dir' => $dir, 'services' => $services]): ?>
+<?php /*
+  One build job per PHP version. buildx bake reads the x-bake platforms from
+  docker-compose.yml and builds both arches on the amd64 runner's "ci" builder,
+  pushing a multi-arch manifest to the tag in the compose `image:` field.
+*/ ?>
+
+<?= $os ?> build:
+  extends: .linux_image_build
+  tags: ["arch:amd64"]
+  parallel:
+    matrix:
+      - PHP_VERSION:
+<?php foreach (array_keys($services) as $svc): ?>
+          - <?= $svc, "\n" ?>
+<?php endforeach; ?>
+  script:
+    - cd <?= $dir, "\n" ?>
+    - docker buildx bake --no-cache --pull --push "${PHP_VERSION}"
+<?php /*
+  Mirror to Docker Hub: one matrix job per OS, independent (needs: [] via
+  .image_publish) so it can sync existing images without rebuilding.
+*/ ?>
+
+<?= $os ?> publish:
+  extends: .image_publish
+  parallel:
+    matrix:
+      - TAG:
+<?php foreach ($services as $tag): ?>
+          - "<?= $tag ?>"
+<?php endforeach; ?>
+<?php endforeach; ?>
diff --git a/.gitlab/generate-package.php b/.gitlab/generate-package.php
index bc760c9e2b4..fe641f9d2a0 100644
--- a/.gitlab/generate-package.php
+++ b/.gitlab/generate-package.php
@@ -5,7 +5,7 @@
 $build_platforms = [
     [
         "triplet" => "x86_64-alpine-linux-musl",
-        "image_template" => "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-compile-extension-alpine-%s",
+        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-compile-extension-alpine-%s",
         "arch" => "amd64",
         "host_os" => "linux-musl",
         "targets" => [
@@ -14,7 +14,7 @@
     ],
     [
       "triplet" => "aarch64-alpine-linux-musl",
-        "image_template" => "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-compile-extension-alpine-%s",
+        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-compile-extension-alpine-%s",
         "arch" => "arm64",
         "host_os" => "linux-musl",
         "targets" => [
@@ -23,7 +23,7 @@
     ],
     [
         "triplet" => "x86_64-unknown-linux-gnu",
-        "image_template" => "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-%s_centos-7",
+        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_centos-7",
         "arch" => "amd64",
         "host_os" => "linux-gnu",
         "targets" => [
@@ -34,7 +34,7 @@
     ],
     [
         "triplet" => "aarch64-unknown-linux-gnu",
-        "image_template" => "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-%s_centos-7",
+        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_centos-7",
         "arch" => "arm64",
         "host_os" => "linux-gnu",
         "targets" => [
@@ -48,13 +48,13 @@
 $asan_build_platforms = [
     [
         "triplet" => "x86_64-unknown-linux-gnu",
-        "image_template" => "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-%s_bookworm-8",
+        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-9",
         "arch" => "amd64",
         "host_os" => "linux-gnu",
     ],
     [
         "triplet" => "aarch64-unknown-linux-gnu",
-        "image_template" => "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-%s_bookworm-8",
+        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-9",
         "arch" => "arm64",
         "host_os" => "linux-gnu",
     ]
@@ -321,7 +321,7 @@
 
 "pecl build":
   stage: tracing
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-7.4_bookworm-8"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-9"
   tags: [ "arch:amd64" ]
   needs: [ "prepare code" ]
   script:
@@ -371,7 +371,7 @@
 <?php foreach ($arch_targets as $arch): ?>
 "aggregate tracing extension: [<?= $arch ?>]":
   stage: tracing
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-7.4_bookworm-8"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-9"
   tags: [ "arch:amd64" ]
   script: ls ./
   variables:
@@ -770,7 +770,7 @@
 
 "x-profiling phpt tests on Alpine":
   stage: verify
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-compile-extension-alpine-$PHP_VERSION"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-compile-extension-alpine-$PHP_VERSION"
   tags: [ "arch:amd64" ]
   parallel:
     matrix:
@@ -1157,7 +1157,7 @@
 
 "pecl tests":
   stage: verify
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_VERSION}_bookworm-8"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_VERSION}_bookworm-9"
   tags: [ "arch:amd64" ]
   services:
     - !reference [.services, request-replayer]
@@ -1190,7 +1190,7 @@
 
 "min install tests":
   stage: verify
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-8.0-shared-ext-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.0-shared-ext-9
   tags: [ "arch:amd64" ]
   variables:
     MAX_TEST_PARALLELISM: 8
@@ -1368,12 +1368,12 @@
 <?php foreach ($arch_targets as $arch): ?>
 "Loader test on <?= $arch ?> libc":
   stage: verify
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${MAJOR_MINOR}_${CONTAINER_SUFFIX}"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${MAJOR_MINOR}_${CONTAINER_SUFFIX}"
   tags: [ "arch:$ARCH" ]
   variables:
     VALGRIND: false
     ARCH: "<?= $arch ?>"
-    CONTAINER_SUFFIX: bookworm-8
+    CONTAINER_SUFFIX: bookworm-9
   needs:
     - job: "package loader: [<?= $arch ?>]"
       artifacts: true
diff --git a/.gitlab/generate-profiler.php b/.gitlab/generate-profiler.php
index 0fd170a5699..72b2300be2b 100644
--- a/.gitlab/generate-profiler.php
+++ b/.gitlab/generate-profiler.php
@@ -13,20 +13,10 @@
 }
 ?>
 
-# PHP 8.5 has a known tailcall VM crash; re-enable once PHP 8.5.8 is available.
-.php_language_profiler_targets: &php_language_profiler_targets
-<?php
-foreach ($profiler_minor_major_targets as $version) {
-    if (version_compare($version, "8.5", "<")) {
-        echo "  - \"{$version}\"\n";
-    }
-}
-?>
-
 "profiling tests":
   stage: test
   tags: [ "arch:${ARCH}" ]
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:${IMAGE_PREFIX}${PHP_MAJOR_MINOR}${IMAGE_SUFFIX}
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:${IMAGE_PREFIX}${PHP_MAJOR_MINOR}${IMAGE_SUFFIX}
   # Setting the *_REQUEST and *_LIMIT variables to be the same, and setting
   # them for both the build and helper allows using Guaranteed QoS instead of
   # Burstable. This means nproc and similar tools will work as expected.
@@ -95,7 +85,7 @@
 "clippy NTS":
   stage: test
   tags: [ "arch:amd64" ]
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-9
   variables:
     KUBERNETES_CPU_REQUEST: 5
     KUBERNETES_CPU_LIMIT: 5
@@ -119,7 +109,7 @@
 "Cargo test":
   stage: test
   tags: [ "arch:amd64" ]
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-8.5_bookworm-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.5_bookworm-9
   variables:
     KUBERNETES_CPU_REQUEST: 5
     KUBERNETES_CPU_LIMIT: 5
@@ -139,7 +129,7 @@
 "PHP language tests":
   stage: test
   tags: [ "arch:${ARCH}" ]
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-9
   variables:
     KUBERNETES_CPU_REQUEST: 5
     KUBERNETES_CPU_LIMIT: 5
@@ -157,7 +147,7 @@
     XFAIL_LIST: dockerfiles/ci/xfail_tests/${PHP_MAJOR_MINOR}.list
   parallel:
     matrix:
-      - PHP_MAJOR_MINOR: *php_language_profiler_targets
+      - PHP_MAJOR_MINOR: *all_profiler_targets
         ARCH: amd64
         FLAVOUR: [nts, zts]
   script:
diff --git a/.gitlab/generate-shared.php b/.gitlab/generate-shared.php
index d3f5f0a4f0f..8b34dda9eb0 100644
--- a/.gitlab/generate-shared.php
+++ b/.gitlab/generate-shared.php
@@ -14,14 +14,14 @@
 "C components ASAN":
   tags: [ "arch:amd64" ]
   stage: test
-  image: "registry.ddbuild.io/images/mirror/${IMAGE}"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:${IMAGE}"
   needs: []
   parallel:
     matrix:
       - IMAGE:
-        - "datadog/dd-trace-ci:centos-7"
-        - "datadog/dd-trace-ci:php-compile-extension-alpine"
-        - "datadog/dd-trace-ci:bookworm-8"
+        - "centos-7"
+        - "php-compile-extension-alpine"
+        - "bookworm-9"
   script:
     - if [ -f "/opt/libuv/lib/pkgconfig/libuv.pc" ]; then export PKG_CONFIG_PATH="/opt/libuv/lib/pkgconfig:$PKG_CONFIG_PATH"; fi
     - if [ -d "/opt/catch2" ]; then export CMAKE_PREFIX_PATH=/opt/catch2; fi
@@ -45,7 +45,7 @@
 "C components UBSAN":
   tags: [ "arch:amd64" ]
   stage: test
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:bookworm-8"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:bookworm-9"
   needs: []
   script:
     - if [ -f "/opt/libuv/lib/pkgconfig/libuv.pc" ]; then export PKG_CONFIG_PATH="/opt/libuv/lib/pkgconfig:$PKG_CONFIG_PATH"; fi
@@ -69,7 +69,7 @@
 "Build & Test Tea":
   tags: [ "arch:amd64" ]
   stage: build
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-8"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-9"
   parallel:
     matrix:
       - PHP_MAJOR_MINOR: *no_asan_minor_major_targets
@@ -98,7 +98,7 @@
 .tea_test:
   tags: [ "arch:amd64" ]
   stage: test
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-8"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-9"
   interruptible: true
   rules:
     - if: $CI_COMMIT_BRANCH == "master"
@@ -122,7 +122,7 @@
   needs: []
   variables:
     PHP_MAJOR_MINOR: "<?= $all_minor_major_targets[count($all_minor_major_targets) - 1] ?>"
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-8"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-9"
   script:
     - |
       if ! command -v cc >/dev/null 2>&1 && ! command -v clang >/dev/null 2>&1 && ! command -v gcc >/dev/null 2>&1; then
@@ -185,7 +185,7 @@
 ?>
 "ZAI Shared Tests: [<?= $major_minor ?>]":
   extends: .tea_test
-  image: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-<?= $major_minor ?>-shared-ext-8"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-<?= $major_minor ?>-shared-ext-9"
   needs:
     - job: "Build & Test Tea"
       parallel:
diff --git a/.gitlab/generate-tracer.php b/.gitlab/generate-tracer.php
index 758881d56bb..c6f1dd1175f 100644
--- a/.gitlab/generate-tracer.php
+++ b/.gitlab/generate-tracer.php
@@ -67,7 +67,7 @@ function before_script_steps($with_docker_auth = false) {
 "compile extension: debug":
   stage: compile
   tags: [ "arch:${ARCH}" ]
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-9
   parallel:
     matrix:
       - PHP_MAJOR_MINOR: *all_minor_major_targets
@@ -186,7 +186,7 @@ function before_script_steps($with_docker_auth = false) {
 .base_test:
   stage: test
   tags: [ "arch:${ARCH}" ]
-  image: registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-8
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-9
   timeout: 60m
   interruptible: true
   rules:
diff --git a/docker-compose.yml b/docker-compose.yml
index 5c8542a2b73..49e4f6458e5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -72,19 +72,19 @@ services:
   # --- Alpine ---
   '8.0-alpine': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0_alpine' }
   # --- Bookworm ---
-  '7.0-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.0_bookworm-8' }
-  '7.1-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.1_bookworm-8' }
-  '7.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.2_bookworm-8' }
-  '7.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.3_bookworm-8' }
-  '7.4-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4_bookworm-8' }
-  '7.4-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4-shared-ext-8' }
-  '8.0-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0_bookworm-8' }
-  '8.0-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0-shared-ext-8' }
-  '8.1-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.1_bookworm-8' }
-  '8.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.2_bookworm-8' }
-  '8.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.3_bookworm-8' }
-  '8.4-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.4_bookworm-8' }
-  '8.5-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.5_bookworm-8' }
+  '7.0-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.0_bookworm-9' }
+  '7.1-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.1_bookworm-9' }
+  '7.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.2_bookworm-9' }
+  '7.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.3_bookworm-9' }
+  '7.4-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4_bookworm-9' }
+  '7.4-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4-shared-ext-9' }
+  '8.0-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0_bookworm-9' }
+  '8.0-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0-shared-ext-9' }
+  '8.1-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.1_bookworm-9' }
+  '8.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.2_bookworm-9' }
+  '8.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.3_bookworm-9' }
+  '8.4-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.4_bookworm-9' }
+  '8.5-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.5_bookworm-9' }
   # --- CentOS 6 ---
   '7.0-centos7': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.0_centos-7' }
   '7.1-centos7': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.1_centos-7' }
diff --git a/dockerfiles/ci/README.md b/dockerfiles/ci/README.md
index 808abe8d9b4..19185b0ce3c 100644
--- a/dockerfiles/ci/README.md
+++ b/dockerfiles/ci/README.md
@@ -1,41 +1,94 @@
 # datadog/dd-trace-ci
 
-The older images can be found in the [DataDog/dd-trace-ci](https://github.com/DataDog/dd-trace-ci/tree/master/php) repo.
+These are the CI images the dd-trace-php pipelines run on: one image per PHP
+version per base OS (Debian "bookworm", CentOS 7, Alpine), plus Windows. They
+are pushed to `registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci` (internal) and
+mirrored to `datadog/dd-trace-ci` on Docker Hub (public). Older images live in
+the [DataDog/dd-trace-ci](https://github.com/DataDog/dd-trace-ci/tree/master/php)
+repo.
+
+## How it works
+
+* **Source of truth:** the `docker-compose.yml` + `.env` in each
+  `dockerfiles/ci/<os>/` directory. Each compose *service* is one image; the
+  service name is the `buildx bake` target, and its `image:` tag (with `.env`
+  vars resolved) is the published tag. PHP versions live here and nowhere else.
+* **Pipeline generation:** `.gitlab/generate-ci-images.php` reads those compose
+  files and emits a GitLab child pipeline — a literal preamble (stages, job
+  templates, and the hand-written Windows jobs) followed by the per-OS Linux
+  build/publish jobs it generates from the compose services. The generator runs
+  inside the `generate-templates` job; the manual `ci-images` job (stage
+  `ci-build`) launches the generated child pipeline.
+* **Build:** `docker buildx bake --no-cache --pull --push` builds the multi-arch
+  (`amd64` + `arm64`) image — the platforms come from the `x-bake` block in the
+  compose file — and pushes a single multi-arch manifest to the internal
+  registry. It runs on the amd64 runner's managed `ci` BuildKit builder, so the
+  build never needs a separate arm64 runner. The job pod only orchestrates;
+  the actual compile happens on the builder, and `MAKE_JOBS` sets its
+  parallelism.
+* **Publish:** a `trigger` to the `DataDog/public-images` service mirrors the
+  internal image to Docker Hub. It has no dependency on the build (see below).
 
-Build and push a specific image:
+## Building via GitLab-CI
 
-```
-docker buildx bake --no-cache --pull --push <image_name>
-```
+This is the preferred way of building the images.
 
-Build and push all images:
+In your pipeline
+([GitLab-CI](https://gitlab.ddbuild.io/DataDog/apm-reliability/dd-trace-php/-/pipelines)),
+manually start the `ci-images` job (stage `ci-build`) to spawn the child
+pipeline. Per OS it has two kinds of jobs:
 
-```
-docker buildx bake --no-cache --pull --push
-```
+1. **`<OS> build: [<version>]`** (manual) — multi-arch build + push to
+   `registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:<tag>`. Run the version(s)
+   you need. Authentication to the internal registry is automatic via the
+   runner's native credentials.
+2. **`<OS> publish`** (manual, a matrix with one instance per tag) — mirrors
+   `…:<tag>` from the internal registry to the public Docker Hub
+   (`datadog/dd-trace-ci`) via a downstream `public-images` pipeline.
 
-## Building via GitLab-CI
+### Publishing is independent of building
 
-This is the preferred way of building the images.
+The `publish` jobs have **no dependencies**: they simply sync whatever currently
+exists in `registry.ddbuild.io` to Docker Hub. The normal flow is build →
+publish, but you can run a `publish` job on its own to (re)provision Docker Hub
+from images already present in the internal registry, without rebuilding
+anything. It is up to you to ensure the image you publish actually exists in
+`registry.ddbuild.io` first.
+
+### Adding or updating a PHP version
+
+* **Bump a patch / RC** (e.g. 8.5.7 → 8.5.8): in that OS's `docker-compose.yml`,
+  update the service's `phpTarGzUrl` and `phpSha256Hash`. The image tag is
+  major.minor, so the image just tracks the latest patch. (`tar xf` autodetects
+  compression, so a `.tar.gz`, `.tar.xz` or `.tar.bz2` URL all work — just use
+  the matching hash.)
+* **Add a new minor**: add a service to the compose file; for bookworm also add
+  a `php-<minor>/Dockerfile` (copy the previous minor's and adjust the
+  `COPY php-<minor>/...` paths). The generator picks the new service up
+  automatically — no pipeline edits needed.
+
+### Troubleshooting: Docker Hub `UNAUTHORIZED` on publish
 
-Find your pipeline with the changes you made in
-[GitLab-CI](https://gitlab.ddbuild.io/DataDog/apm-reliability/dd-trace-php/-/pipelines)
-and manually start the jobs to build the images for the OS you need. You need to
-add the following CI variables to the job run:
+If a `publish` job reaches Docker Hub but fails with `UNAUTHORIZED` pushing to
+`datadog/dd-trace-ci`, the dd-trace-php side is usually correct — it means the
+`public-images` Docker Hub service account is not allowed to push to that repo.
+Ask the `public-images` / Agent Delivery owners to grant it write access; there
+is nothing to change in this repo.
 
-- `CI_REGISTRY_USER`: should be your Docker Hub username
-- `CI_REGISTRY_TOKEN`: should be your access token
+## Building locally
 
-In case you don't have one, follow the [docs to create an access
-token](https://docs.docker.com/docker-hub/access-tokens/#create-an-access-token).
+Build and push a specific image (or all of them) from the OS directory:
 
-## Building locally and need more speed?
+```
+docker buildx bake --no-cache --pull --push <image_name>
+docker buildx bake --no-cache --pull --push
+```
 
 Building the containers that match your host platform is usually fast enough to
 just wait. But building the containers for the other platform (`arm64` vs.
 `amd64`) is super slow as those builds are running in QEMU.
 
-Builder-Instances for the rescue:
+Builder-Instances to the rescue:
 - Boot up an ARM64 and an AMD64 instance in AWS with Ubuntu
 - [Install Docker](https://docs.docker.com/engine/install/ubuntu/) on both
 - make Docker executable with the [ubuntu user](https://docs.docker.com/engine/install/linux-postinstall/)
diff --git a/dockerfiles/ci/alpine/docker-compose.yml b/dockerfiles/ci/alpine/docker-compose.yml
index 525bb61fb44..eb4015cd527 100644
--- a/dockerfiles/ci/alpine/docker-compose.yml
+++ b/dockerfiles/ci/alpine/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
 services:
 
   base:
-    image: datadog/dd-trace-ci:alpine
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:alpine
     build:
       context: .
       x-bake: &bake
@@ -12,7 +12,7 @@ services:
           - linux/amd64
 
   php-8.0:
-    image: datadog/dd-trace-ci:php-8.0_alpine
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.0_alpine
     build:
       context: ./php-8.0
       args:
diff --git a/dockerfiles/ci/alpine/php-8.0/Dockerfile b/dockerfiles/ci/alpine/php-8.0/Dockerfile
index 4ecb3c521d7..1017f7b4634 100644
--- a/dockerfiles/ci/alpine/php-8.0/Dockerfile
+++ b/dockerfiles/ci/alpine/php-8.0/Dockerfile
@@ -1,4 +1,5 @@
-FROM datadog/dd-trace-ci:alpine AS base
+ARG CI_REGISTRY_IMAGE=datadog/dd-trace-ci
+FROM ${CI_REGISTRY_IMAGE}:alpine AS base
 
 ARG phpVersion
 ENV PHP_INSTALL_DIR_DEBUG_ZTS=${PHP_INSTALL_DIR}/${phpVersion}-debug-zts
diff --git a/dockerfiles/ci/alpine_compile_extension/Dockerfile b/dockerfiles/ci/alpine_compile_extension/Dockerfile
index a7a694ec532..da8045e2ca5 100644
--- a/dockerfiles/ci/alpine_compile_extension/Dockerfile
+++ b/dockerfiles/ci/alpine_compile_extension/Dockerfile
@@ -1,4 +1,5 @@
-FROM datadog/dd-trace-ci:php-compile-extension-alpine
+ARG CI_REGISTRY_IMAGE=datadog/dd-trace-ci
+FROM ${CI_REGISTRY_IMAGE}:php-compile-extension-alpine
 
 ADD 0001-Backport-0a39890c-Fix-libxml2-2.12-build-due-to-API-.patch /patches/0001-Backport-0a39890c-Fix-libxml2-2.12-build-due-to-API-.patch
 ADD 0001-Sync-callback-signature-with-libxml2-2.9.8.patch /patches/0001-Sync-callback-signature-with-libxml2-2.9.8.patch
diff --git a/dockerfiles/ci/alpine_compile_extension/docker-compose.yml b/dockerfiles/ci/alpine_compile_extension/docker-compose.yml
index 52892420c92..62c580ce40d 100644
--- a/dockerfiles/ci/alpine_compile_extension/docker-compose.yml
+++ b/dockerfiles/ci/alpine_compile_extension/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
 services:
 
   base-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine
     build:
       context: .
       dockerfile: base.Dockerfile
@@ -11,15 +11,20 @@ services:
         platforms:
           - linux/arm64
           - linux/amd64
+      args: &build-base
+        # Build php images FROM the (possibly freshly built) internal base,
+        # not the Docker Hub fallback baked into the Dockerfile ARG default.
+        CI_REGISTRY_IMAGE: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}
     volumes:
         - ../../:/app
 
   7.0-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-7.0
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-7.0
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.0.33
         phpSha256Hash: d71a6ecb6b13dc53fed7532a7f8f949c4044806f067502f8fb6f9facbb40452a
         phpApi: 20151012
@@ -27,11 +32,12 @@ services:
         - ../../:/app
 
   7.1-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-7.1
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-7.1
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.1.33
         phpSha256Hash: 0055f368ffefe51d5a4483755bd17475e88e74302c08b727952831c5b2682ea2
         phpApi: 20160303
@@ -39,11 +45,12 @@ services:
         - ../../:/app
 
   7.2-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-7.2
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-7.2
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.2.34
         phpSha256Hash: 8b2777c741e83f188d3ca6d8e98ece7264acafee86787298fae57e05d0dddc78
         phpApi: 20170718
@@ -51,11 +58,12 @@ services:
         - ../../:/app
 
   7.3-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-7.3
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-7.3
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.3.33
         phpSha256Hash: 9a369c32c6f52036b0a890f290327f148a1904ee66aa56e2c9a7546da6525ec8
         phpApi: 20180731
@@ -63,11 +71,12 @@ services:
         - ../../:/app
 
   7.4-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-7.4
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-7.4
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.4.33
         phpSha256Hash: 5a2337996f07c8a097e03d46263b5c98d2c8e355227756351421003bea8f463e
         phpApi: 20190902
@@ -75,11 +84,12 @@ services:
         - ../../:/app
 
   8.0-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-8.0
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-8.0
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.0.30
         phpSha256Hash: 449d2048fcb20a314d8c218097c6d1047a9f1c5bb72aa54d5d3eba0a27a4c80c
         phpApi: 20200930
@@ -87,11 +97,12 @@ services:
       - ../../:/app
 
   8.1-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-8.1
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-8.1
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.1.31
         phpSha256Hash: 618923b407c4575bfee085f00c4aaa16a5cc86d4b1eb893c0f352d61541bbfb1
         phpApi: 20210902
@@ -99,11 +110,12 @@ services:
       - ../../:/app
 
   8.2-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-8.2
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-8.2
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.2.31
         phpSha256Hash: 083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870
         phpApi: 20220829
@@ -111,11 +123,12 @@ services:
       - ../../:/app
 
   8.3-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-8.3
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-8.3
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.3.31
         phpSha256Hash: 4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f
         phpApi: 20230831
@@ -123,11 +136,12 @@ services:
       - ../../:/app
 
   8.4-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-8.4
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-8.4
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.4.22
         phpSha256Hash: a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823
         phpApi: 20240924
@@ -135,11 +149,12 @@ services:
       - ../../:/app
 
   8.5-alpine:
-    image: datadog/dd-trace-ci:php-compile-extension-alpine-8.5
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-compile-extension-alpine-8.5
     build:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.5.7
         phpSha256Hash: "e5eba93fd6dd3241d0e61e932eb99a3783b40568553fb0e511b660ecd863a049"
         phpApi: 20250925
diff --git a/dockerfiles/ci/bookworm/build-extensions.sh b/dockerfiles/ci/bookworm/build-extensions.sh
index a619baaba14..b7f44f5784b 100755
--- a/dockerfiles/ci/bookworm/build-extensions.sh
+++ b/dockerfiles/ci/bookworm/build-extensions.sh
@@ -11,6 +11,8 @@ if [[ -z "${MAKE_JOBS:-}" || "${MAKE_JOBS}" == "0" ]]; then
   MAKE_JOBS="$(nproc)"
 fi
 
+export MAKEFLAGS="-j$MAKE_JOBS"
+
 XDEBUG_VERSIONS=(-3.1.2)
 if [[ $PHP_VERSION_ID -le 70 ]]; then
   XDEBUG_VERSIONS=(-2.7.2)
diff --git a/dockerfiles/ci/bookworm/docker-compose.yml b/dockerfiles/ci/bookworm/docker-compose.yml
index 8f167dfb7e6..643c39a1779 100644
--- a/dockerfiles/ci/bookworm/docker-compose.yml
+++ b/dockerfiles/ci/bookworm/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
 services:
 
   base:
-    image: datadog/dd-trace-ci:bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       x-bake: &bake
@@ -11,11 +11,11 @@ services:
           - linux/arm64
           - linux/amd64
       args: &build-base
-        BUILD_BASE: datadog/dd-trace-ci:bookworm-$BOOKWORM_NEXT_VERSION
+        BUILD_BASE: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:bookworm-$BOOKWORM_NEXT_VERSION
         MAKE_JOBS: ${MAKE_JOBS:-}
 
   php-8.5:
-    image: datadog/dd-trace-ci:php-8.5_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.5_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-8.5/Dockerfile
@@ -23,11 +23,12 @@ services:
       args:
         <<: *build-base
         phpVersion: "8.5"
-        phpTarGzUrl: https://www.php.net/distributions/php-8.5.7.tar.gz
-        phpSha256Hash: "e5eba93fd6dd3241d0e61e932eb99a3783b40568553fb0e511b660ecd863a049"
+        # 8.5.8RC1 (RC sources from ~daniels until 8.5.8 GA, ~2 Jul 2026).
+        phpTarGzUrl: https://downloads.php.net/~daniels/php-8.5.8RC1.tar.gz
+        phpSha256Hash: "57f93d2e0d76a26ac955e30cfab81dd910fc48e8bf78b3a15ff67df63a92ac72"
 
   php-8.4:
-    image: datadog/dd-trace-ci:php-8.4_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.4_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-8.4/Dockerfile
@@ -39,7 +40,7 @@ services:
         phpSha256Hash: "a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823"
 
   php-8.3:
-    image: datadog/dd-trace-ci:php-8.3_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.3_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-8.3/Dockerfile
@@ -51,7 +52,7 @@ services:
         phpSha256Hash: "4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f"
 
   php-8.2:
-    image: datadog/dd-trace-ci:php-8.2_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.2_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-8.2/Dockerfile
@@ -63,7 +64,7 @@ services:
         phpSha256Hash: "083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870"
 
   php-8.1:
-    image: datadog/dd-trace-ci:php-8.1_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.1_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-8.1/Dockerfile
@@ -75,7 +76,7 @@ services:
         phpSha256Hash: "4846836d1de27dbd28e89180f073531087029a77e98e8e019b7b2eddbdb1baff"
 
   php-8.0:
-    image: datadog/dd-trace-ci:php-8.0_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.0_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-8.0/Dockerfile
@@ -87,7 +88,7 @@ services:
         phpSha256Hash: "449d2048fcb20a314d8c218097c6d1047a9f1c5bb72aa54d5d3eba0a27a4c80c"
 
   php-8.0-shared-ext:
-    image: datadog/dd-trace-ci:php-8.0-shared-ext-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.0-shared-ext-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-8.0/Dockerfile
@@ -100,7 +101,7 @@ services:
         phpSha256Hash: "449d2048fcb20a314d8c218097c6d1047a9f1c5bb72aa54d5d3eba0a27a4c80c"
 
   php-7.4:
-    image: datadog/dd-trace-ci:php-7.4_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.4_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-7.4/Dockerfile
@@ -112,7 +113,7 @@ services:
         phpSha256Hash: 5a2337996f07c8a097e03d46263b5c98d2c8e355227756351421003bea8f463e
 
   php-7.4-shared-ext:
-    image: datadog/dd-trace-ci:php-7.4-shared-ext-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.4-shared-ext-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-7.4/Dockerfile
@@ -125,7 +126,7 @@ services:
         phpSha256Hash: 5a2337996f07c8a097e03d46263b5c98d2c8e355227756351421003bea8f463e
 
   php-7.3:
-    image: datadog/dd-trace-ci:php-7.3_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.3_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-7.3/Dockerfile
@@ -137,7 +138,7 @@ services:
         phpSha256Hash: 9a369c32c6f52036b0a890f290327f148a1904ee66aa56e2c9a7546da6525ec8
 
   php-7.2:
-    image: datadog/dd-trace-ci:php-7.2_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.2_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-7.2/Dockerfile
@@ -149,7 +150,7 @@ services:
         phpSha256Hash: 8b2777c741e83f188d3ca6d8e98ece7264acafee86787298fae57e05d0dddc78
 
   php-7.1:
-    image: datadog/dd-trace-ci:php-7.1_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.1_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-7.1/Dockerfile
@@ -161,7 +162,7 @@ services:
         phpSha256Hash: 0055f368ffefe51d5a4483755bd17475e88e74302c08b727952831c5b2682ea2
 
   php-7.0:
-    image: datadog/dd-trace-ci:php-7.0_bookworm-$BOOKWORM_NEXT_VERSION
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.0_bookworm-$BOOKWORM_NEXT_VERSION
     build:
       context: .
       dockerfile: php-7.0/Dockerfile
diff --git a/dockerfiles/ci/centos/7/docker-compose.yml b/dockerfiles/ci/centos/7/docker-compose.yml
index 2b427a95ba1..7879c1ab7ac 100644
--- a/dockerfiles/ci/centos/7/docker-compose.yml
+++ b/dockerfiles/ci/centos/7/docker-compose.yml
@@ -2,7 +2,7 @@ version: '3'
 
 services:
   base:
-    image: 'datadog/dd-trace-ci:centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:centos-7'
     build:
       context: .
       dockerfile: base.Dockerfile
@@ -10,6 +10,10 @@ services:
         platforms:
           - linux/arm64
           - linux/amd64
+      args: &build-base
+        # Build php images FROM the (possibly freshly built) internal base,
+        # not the Docker Hub fallback baked into the Dockerfile ARG default.
+        CI_REGISTRY_IMAGE: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}
 
   php-7.0:
     build:
@@ -17,10 +21,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.0"
         phpTarGzUrl: https://www.php.net/distributions/php-7.0.33.tar.gz
         phpSha256Hash: d71a6ecb6b13dc53fed7532a7f8f949c4044806f067502f8fb6f9facbb40452a
-    image: 'datadog/dd-trace-ci:php-7.0_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.0_centos-7'
 
   php-7.1:
     build:
@@ -28,10 +33,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.1"
         phpTarGzUrl: https://www.php.net/distributions/php-7.1.33.tar.gz
         phpSha256Hash: 0055f368ffefe51d5a4483755bd17475e88e74302c08b727952831c5b2682ea2
-    image: 'datadog/dd-trace-ci:php-7.1_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.1_centos-7'
 
   php-7.2:
     build:
@@ -39,10 +45,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.2"
         phpTarGzUrl: https://www.php.net/distributions/php-7.2.34.tar.gz
         phpSha256Hash: 8b2777c741e83f188d3ca6d8e98ece7264acafee86787298fae57e05d0dddc78
-    image: 'datadog/dd-trace-ci:php-7.2_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.2_centos-7'
 
   php-7.3:
     build:
@@ -50,10 +57,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.3"
         phpTarGzUrl: https://www.php.net/distributions/php-7.3.33.tar.gz
         phpSha256Hash: 9a369c32c6f52036b0a890f290327f148a1904ee66aa56e2c9a7546da6525ec8
-    image: 'datadog/dd-trace-ci:php-7.3_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.3_centos-7'
 
   php-7.4:
     build:
@@ -61,10 +69,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.4"
         phpTarGzUrl: https://www.php.net/distributions/php-7.4.33.tar.gz
         phpSha256Hash: 5a2337996f07c8a097e03d46263b5c98d2c8e355227756351421003bea8f463e
-    image: 'datadog/dd-trace-ci:php-7.4_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.4_centos-7'
 
   php-8.0:
     build:
@@ -72,10 +81,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.0"
         phpTarGzUrl: https://www.php.net/distributions/php-8.0.30.tar.gz
         phpSha256Hash: 449d2048fcb20a314d8c218097c6d1047a9f1c5bb72aa54d5d3eba0a27a4c80c
-    image: 'datadog/dd-trace-ci:php-8.0_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.0_centos-7'
 
   php-8.1:
     build:
@@ -83,10 +93,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.1"
         phpTarGzUrl: https://www.php.net/distributions/php-8.1.32.tar.gz
         phpSha256Hash: "4846836d1de27dbd28e89180f073531087029a77e98e8e019b7b2eddbdb1baff"
-    image: 'datadog/dd-trace-ci:php-8.1_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.1_centos-7'
 
   php-8.2:
     build:
@@ -94,10 +105,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.2"
         phpTarGzUrl: https://www.php.net/distributions/php-8.2.31.tar.gz
         phpSha256Hash: "083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870"
-    image: 'datadog/dd-trace-ci:php-8.2_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.2_centos-7'
 
   php-8.3:
     build:
@@ -105,10 +117,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.3"
         phpTarGzUrl: https://www.php.net/distributions/php-8.3.31.tar.gz
         phpSha256Hash: "4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f"
-    image: 'datadog/dd-trace-ci:php-8.3_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.3_centos-7'
 
   php-8.4:
     build:
@@ -116,10 +129,11 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.4"
         phpTarGzUrl: https://www.php.net/distributions/php-8.4.22.tar.gz
         phpSha256Hash: "a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823"
-    image: 'datadog/dd-trace-ci:php-8.4_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.4_centos-7'
 
   php-8.5:
     build:
@@ -127,7 +141,8 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.5"
         phpTarGzUrl: https://www.php.net/distributions/php-8.5.7.tar.gz
         phpSha256Hash: "e5eba93fd6dd3241d0e61e932eb99a3783b40568553fb0e511b660ecd863a049"
-    image: 'datadog/dd-trace-ci:php-8.5_centos-7'
+    image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.5_centos-7'
diff --git a/dockerfiles/ci/centos/7/php.Dockerfile b/dockerfiles/ci/centos/7/php.Dockerfile
index 281af3e10e8..267435cb40f 100644
--- a/dockerfiles/ci/centos/7/php.Dockerfile
+++ b/dockerfiles/ci/centos/7/php.Dockerfile
@@ -1,4 +1,5 @@
-FROM datadog/dd-trace-ci:centos-7 AS base
+ARG CI_REGISTRY_IMAGE=datadog/dd-trace-ci
+FROM ${CI_REGISTRY_IMAGE}:centos-7 AS base
 
 ENV PHP_SRC_DIR=/usr/local/src/php
 ENV PHP_INSTALL_DIR=/opt/php
diff --git a/dockerfiles/ci/windows/Dockerfile b/dockerfiles/ci/windows/Dockerfile
index d3b7a1c4858..c8e48a59b4d 100644
--- a/dockerfiles/ci/windows/Dockerfile
+++ b/dockerfiles/ci/windows/Dockerfile
@@ -1,5 +1,6 @@
+ARG CI_REGISTRY_IMAGE=datadog/dd-trace-ci
 ARG vsVersion
-FROM datadog/dd-trace-ci:windows-$vsVersion AS base
+FROM ${CI_REGISTRY_IMAGE}:windows-$vsVersion AS base
 
 ARG phpTarGzUrl
 ARG phpVersion
diff --git a/dockerfiles/ci/windows/basetools.Dockerfile b/dockerfiles/ci/windows/basetools.Dockerfile
index 001f9f553e9..3910c325634 100644
--- a/dockerfiles/ci/windows/basetools.Dockerfile
+++ b/dockerfiles/ci/windows/basetools.Dockerfile
@@ -1,5 +1,6 @@
+ARG CI_REGISTRY_IMAGE=datadog/dd-trace-ci
 ARG vsVersion
-FROM datadog/dd-trace-ci:windows-base-$vsVersion
+FROM ${CI_REGISTRY_IMAGE}:windows-base-$vsVersion
 
 RUN powershell.exe "Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; $Env:chocolateyVersion = '0.10.15'; $Env:chocolateyUseWindowsCompression = 'false'; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')); ''"
 
diff --git a/dockerfiles/ci/windows/docker-compose.yml b/dockerfiles/ci/windows/docker-compose.yml
index 86fde8f34e9..81e4c384f1e 100644
--- a/dockerfiles/ci/windows/docker-compose.yml
+++ b/dockerfiles/ci/windows/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
 services:
 
   vc15-base:
-    image: datadog/dd-trace-ci:windows-base-vc15
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:windows-base-vc15
     build:
       platforms:
         - windows/amd64
@@ -11,7 +11,7 @@ services:
       dockerfile: vc15.Dockerfile
 
   vs16-base:
-    image: datadog/dd-trace-ci:windows-base-vs16
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:windows-base-vs16
     build:
       platforms:
         - windows/amd64
@@ -19,7 +19,7 @@ services:
       dockerfile: vs16.Dockerfile
 
   vs17-base:
-    image: datadog/dd-trace-ci:windows-base-vs17
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:windows-base-vs17
     build:
       platforms:
         - windows/amd64
@@ -27,7 +27,7 @@ services:
       dockerfile: vs17.Dockerfile
 
   vc15:
-    image: datadog/dd-trace-ci:windows-vc15
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:windows-vc15
     build:
       platforms:
         - windows/amd64
@@ -38,7 +38,7 @@ services:
         sdkVersion: "2.2.0"
 
   vs16:
-    image: datadog/dd-trace-ci:windows-vs16
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:windows-vs16
     build:
       platforms:
         - windows/amd64
@@ -49,7 +49,7 @@ services:
         sdkVersion: "2.2.0"
 
   vs17:
-    image: datadog/dd-trace-ci:windows-vs17
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:windows-vs17
     build:
       platforms:
         - windows/amd64
@@ -60,7 +60,7 @@ services:
         sdkVersion: "2.3.0"
 
   php-8.5:
-    image: datadog/dd-trace-ci:php-8.5_windows
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.5_windows
     build:
       platforms:
         - windows/amd64
@@ -72,7 +72,7 @@ services:
         phpSha256Hash: "e5eba93fd6dd3241d0e61e932eb99a3783b40568553fb0e511b660ecd863a049"
 
   php-8.4:
-    image: datadog/dd-trace-ci:php-8.4_windows
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.4_windows
     build:
       platforms:
         - windows/amd64
@@ -84,7 +84,7 @@ services:
         phpSha256Hash: "a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823"
 
   php-8.3:
-    image: datadog/dd-trace-ci:php-8.3_windows
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.3_windows
     build:
       platforms:
         - windows/amd64
@@ -96,7 +96,7 @@ services:
         phpSha256Hash: "4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f"
 
   php-8.2:
-    image: datadog/dd-trace-ci:php-8.2_windows
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.2_windows
     build:
       platforms:
         - windows/amd64
@@ -108,7 +108,7 @@ services:
         phpSha256Hash: "083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870"
 
   php-8.1:
-    image: datadog/dd-trace-ci:php-8.1_windows
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.1_windows
     build:
       platforms:
         - windows/amd64
@@ -120,7 +120,7 @@ services:
         phpSha256Hash: "4846836d1de27dbd28e89180f073531087029a77e98e8e019b7b2eddbdb1baff"
 
   php-8.0:
-    image: datadog/dd-trace-ci:php-8.0_windows
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.0_windows
     build:
       platforms:
         - windows/amd64
@@ -132,7 +132,7 @@ services:
         phpSha256Hash: "449d2048fcb20a314d8c218097c6d1047a9f1c5bb72aa54d5d3eba0a27a4c80c"
 
   php-7.4:
-    image: datadog/dd-trace-ci:php-7.4_windows
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.4_windows
     build:
       platforms:
         - windows/amd64
@@ -144,7 +144,7 @@ services:
         phpSha256Hash: 5a2337996f07c8a097e03d46263b5c98d2c8e355227756351421003bea8f463e
 
   php-7.3:
-    image: datadog/dd-trace-ci:php-7.3_windows
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.3_windows
     build:
       platforms:
         - windows/amd64
@@ -156,7 +156,7 @@ services:
         phpSha256Hash: 9a369c32c6f52036b0a890f290327f148a1904ee66aa56e2c9a7546da6525ec8
 
   php-7.2:
-    image: datadog/dd-trace-ci:php-7.2_windows
+    image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-7.2_windows
     build:
       platforms:
         - windows/amd64
diff --git a/tooling/bin/build-debug-artifact b/tooling/bin/build-debug-artifact
index dc8a72cc7ac..97fe09e97a2 100755
--- a/tooling/bin/build-debug-artifact
+++ b/tooling/bin/build-debug-artifact
@@ -115,7 +115,7 @@ case "$php_version" in
 esac
 
 # ─── Docker image selection ───────────────────────────────────────────────────
-BOOKWORM_VERSION=8
+BOOKWORM_VERSION=9
 if [[ "$libc" == "musl" ]]; then
     DOCKER_IMAGE="datadog/dd-trace-ci:php-compile-extension-alpine-${php_version}"
 else