diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d60bcb3..d1017537 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   list.
 - Added a missing `.ww` extension to the `70-ww4-netname.rules` template in the
   wwinit overlay.
+- Restrict access to `/warewulf/config` to root only. (#728, #742)
 
 ### Changed
 
diff --git a/Makefile b/Makefile
index 2772c723..61e470bc 100644
--- a/Makefile
+++ b/Makefile
@@ -188,7 +188,7 @@ files: all
 	chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*
 	chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/NetworkManager/system-connections/ww4-managed.ww
 	chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*.pub.ww
-	chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/warewulf/config.ww
+	chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/warewulf/config.ww
 	chmod 750 $(DESTDIR)$(WWOVERLAYDIR)/host
 	install -m 0755 wwctl $(DESTDIR)$(BINDIR)
 	install -m 0755 wwapic $(DESTDIR)$(BINDIR)
diff --git a/internal/app/api/wwapird_curls/curls.sh b/internal/app/api/wwapird_curls/curls.sh
index a9f95d54..e4f6ac01 100644
--- a/internal/app/api/wwapird_curls/curls.sh
+++ b/internal/app/api/wwapird_curls/curls.sh
@@ -15,7 +15,7 @@ curl --cacert /usr/local/etc/warewulf/keys/cacert.pem \
 curl http://localhost:9871/v1/container
 
 # container import
-curl -d '{"source": "docker://warewulf/rocky:8", "name": "rocky-8", "update": true, "default": true}' -H "Content-Type: application/json" -X POST http://localhost:9871/v1/container
+curl -d '{"source": "docker://ghcr.io/hpcng/warewulf-rockylinux:8", "name": "rocky-8", "update": true, "default": true}' -H "Content-Type: application/json" -X POST http://localhost:9871/v1/container
 
 # container delete
 curl -X DELETE http://localhost:9871/v1/container?containerNames=rocky-8
@@ -54,4 +54,4 @@ curl http://localhost:9871/v1/nodestatus?nodeNames=testApiNode0
 
 # node delete single node
 curl -X DELETE http://localhost:9871/v1/node?nodeNames=testApiNode0
-curl -X DELETE http://localhost:9871/v1/node?nodeNames=testApiNode1
\ No newline at end of file
+curl -X DELETE http://localhost:9871/v1/node?nodeNames=testApiNode1
diff --git a/internal/app/wwctl/container/imprt/root.go b/internal/app/wwctl/container/imprt/root.go
index bd3a563b..edafc127 100644
--- a/internal/app/wwctl/container/imprt/root.go
+++ b/internal/app/wwctl/container/imprt/root.go
@@ -16,7 +16,7 @@ are:
  * /path/to/archive/tar/ball
  * /path/to/chroot/
 Imported containers are used to create bootable VNFS images.`,
-		Example: "wwctl container import docker://warewulf/centos-8 my_container",
+		Example: "wwctl container import docker://ghcr.io/hpcng/warewulf-rockylinux:8 rockylinux-8",
 		RunE:    CobraRunE,
 		Args:    cobra.MinimumNArgs(1),
 	}
diff --git a/userdocs/contents/containers.rst b/userdocs/contents/containers.rst
index c8b0a5d3..641d023b 100644
--- a/userdocs/contents/containers.rst
+++ b/userdocs/contents/containers.rst
@@ -48,7 +48,7 @@ Here is an example of importing from Docker Hub.
 
 .. code-block:: console
 
-   # wwctl container import docker://warewulf/rocky rocky-8
+   # wwctl container import docker://ghcr.io/hpcng/warewulf-rockylinux:8 rocky-8
    Getting image source signatures
    Copying blob d7f16ed6f451 done
    Copying config da2ca70704 done
diff --git a/userdocs/contributing/development-environment-kvm.rst b/userdocs/contributing/development-environment-kvm.rst
index 023b3eb9..83149f9f 100644
--- a/userdocs/contributing/development-environment-kvm.rst
+++ b/userdocs/contributing/development-environment-kvm.rst
@@ -102,7 +102,7 @@ Build and install Warewulf on wwdev
    sudo wwctl configure ssh  # Build the basic ssh keys to be included by the default system overlay
 
    # Pull and build the VNFS container and kernel
-   sudo wwctl container import docker://warewulf/centos-8 centos-8 --setdefault
+   sudo wwctl container import docker://ghcr.io/hpcng/warewulf-centos:7 centos-7 --setdefault
    sudo wwctl kernel import build $(uname -r) --setdefault
 
    # Set up the default node profile
diff --git a/userdocs/contributing/development-environment-vbox.rst b/userdocs/contributing/development-environment-vbox.rst
index 8d504aa5..e432466c 100644
--- a/userdocs/contributing/development-environment-vbox.rst
+++ b/userdocs/contributing/development-environment-vbox.rst
@@ -117,7 +117,7 @@ I have VirtualBox running on my desktop.
    sudo wwctl configure ssh  --persist # Build the basic ssh keys to be included by the default system overlay
 
    # Pull and build the VNFS container and kernel
-   sudo wwctl container import docker://warewulf/centos-7 centos-7 --setdefault
+   sudo wwctl container import docker://ghcr.io/hpcng/warewulf-centos:7 centos-7 --setdefault
    sudo wwctl kernel import build $(uname -r) --setdefault
 
    # Set up the default node profile
diff --git a/userdocs/quickstart/el7.rst b/userdocs/quickstart/el7.rst
index a82445cd..c5859d56 100644
--- a/userdocs/quickstart/el7.rst
+++ b/userdocs/quickstart/el7.rst
@@ -103,7 +103,7 @@ default running kernel from the controller node and set both in the
 
 .. code-block:: bash
 
-   sudo wwctl container import docker://warewulf/centos-7 centos-7 --setdefault
+   sudo wwctl container import docker://ghcr.io/hpcng/warewulf-centos:7 centos-7 --setdefault
    sudo wwctl kernel import $(uname -r) --setdefault
 
 Set up the default node profile
diff --git a/userdocs/quickstart/el8.rst b/userdocs/quickstart/el8.rst
index 215b0037..4c812914 100644
--- a/userdocs/quickstart/el8.rst
+++ b/userdocs/quickstart/el8.rst
@@ -105,7 +105,7 @@ default running kernel from the controller node and set both in the
 
 .. code-block:: bash
 
-   sudo wwctl container import docker://warewulf/rocky:8 rocky-8
+   sudo wwctl container import docker://ghcr.io/hpcng/warewulf-rockylinux:8 rocky-8
 
 
 Set up the default node profile