diff --git a/mirror_images.yaml b/mirror_images.yaml
new file mode 100644
index 00000000000..42279fc8825
--- /dev/null
+++ b/mirror_images.yaml
@@ -0,0 +1,67 @@
+# Images to mirror into registry.ddbuild.io.
+# See: https://github.com/DataDog/dd-repo-tools/blob/main/shared/mirror-images/mirror_images.md
+#
+# Targets default to `registry.ddbuild.io/ci/system-tests/mirror/<source>`.
+# To mirror the same source list into ghcr.io (for GitHub-hosted CI), run:
+#
+#   MIRROR_DEST_REGISTRY=ghcr.io/datadog/system-tests \
+#     utils/mirror_images.sh lock -o mirror_images.ghcr.lock.yaml
+#   MIRROR_DEST_REGISTRY=ghcr.io/datadog/system-tests \
+#     utils/mirror_images.sh mirror --lock-yaml mirror_images.ghcr.lock.yaml
+
+images:
+  # Bare-name & docker.io images
+  - amazonlinux:2023
+  - apache/spark:3.4.4
+  - datadog/dd-trace-ci:php-8.2_bookworm-6
+  - debian:bookworm-slim
+  - docker.io/datadog/dd-lib-ruby-init:latest
+  - golang:1.25
+  - maven:3-eclipse-temurin-21
+  - node:13
+  - node:18.10-slim
+  - openjdk:7-alpine
+  - python:2.7
+  - python:3.11-slim
+  - ruby:3.1.3
+  - rust:1.87-slim-bookworm
+  - ubuntu:22.04
+
+  # gcr.io
+  - gcr.io/datadoghq/agent:7.78.4
+
+  # ghcr.io
+  - ghcr.io/datadog/dd-trace-rb/dd-lib-ruby-init:latest_snapshot
+
+  # mcr.microsoft.com (.NET)
+  - mcr.microsoft.com/dotnet/aspnet:2.1-stretch-slim
+  - mcr.microsoft.com/dotnet/aspnet:6.0
+  - mcr.microsoft.com/dotnet/aspnet:6.0-alpine
+  - mcr.microsoft.com/dotnet/aspnet:8.0
+  - mcr.microsoft.com/dotnet/aspnet:8.0-alpine
+  - mcr.microsoft.com/dotnet/sdk:6.0-alpine
+  - mcr.microsoft.com/dotnet/sdk:7.0
+  - mcr.microsoft.com/dotnet/sdk:7.0.100
+  - mcr.microsoft.com/dotnet/sdk:7.0.100-preview.2
+  - mcr.microsoft.com/dotnet/sdk:8.0
+  - mcr.microsoft.com/dotnet/sdk:8.0-alpine
+
+  # internal Datadog ECR (legacy PHP CI image)
+  - 669783387624.dkr.ecr.us-east-1.amazonaws.com/dockerhub/library/php:5.6-cli
+
+ignore:
+  images:
+    # Multi-stage Dockerfile stage names (not registry refs).
+    - "base"
+    - "build"
+    - "dd-lib-init_.+"
+    # docker-compose local `build:` targets (no registry).
+    - "reverseproxy:latest"
+    - "system-tests/.+:latest"
+    # Dockerfile ARG-substituted refs — resolved at build time, can't be
+    # lint-validated as static images.
+    - ".*\\$\\{?RUNTIME\\}?.*"
+    - ".*\\$\\{?TARGETARCH\\}?.*"
+    # public.ecr.aws is AWS's public mirror of Docker Hub — treated as a
+    # trusted upstream that does not need to be re-mirrored.
+    - "public\\.ecr\\.aws/.*"
diff --git a/utils/mirror_images.sh b/utils/mirror_images.sh
new file mode 100755
index 00000000000..eb939c61e87
--- /dev/null
+++ b/utils/mirror_images.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec uv run --no-config --script \
+    https://binaries.ddbuild.io/dd-repo-tools/default/ca/fb4f39a542e4dd42b646c300b539c7a9f4201531/mirror_images.py \
+    "$@"