diff --git a/.git-crypt/.gitattributes b/.git-crypt/.gitattributes
deleted file mode 100644
index 17ef6016c..000000000
--- a/.git-crypt/.gitattributes
+++ /dev/null
@@ -1,3 +0,0 @@
-# Do not edit this file.  To specify the files to encrypt, create your own
-# .gitattributes file in the directory where your files are.
-* !filter !diff
diff --git a/.git-crypt/keys/default/0/15476E78262C1E3CB37095DE4C68E0F19F95EC33.gpg b/.git-crypt/keys/default/0/15476E78262C1E3CB37095DE4C68E0F19F95EC33.gpg
deleted file mode 100644
index bcc305e23..000000000
Binary files a/.git-crypt/keys/default/0/15476E78262C1E3CB37095DE4C68E0F19F95EC33.gpg and /dev/null differ
diff --git a/.git-crypt/keys/default/0/2583D03F747BF75DA761DAC4565C11F0FFCFA4EC.gpg b/.git-crypt/keys/default/0/2583D03F747BF75DA761DAC4565C11F0FFCFA4EC.gpg
deleted file mode 100644
index 430573af9..000000000
Binary files a/.git-crypt/keys/default/0/2583D03F747BF75DA761DAC4565C11F0FFCFA4EC.gpg and /dev/null differ
diff --git a/.git-crypt/keys/default/0/79BD02F25334F112CF8B5CC9BA44BA8341537357.gpg b/.git-crypt/keys/default/0/79BD02F25334F112CF8B5CC9BA44BA8341537357.gpg
deleted file mode 100644
index bbc29c798..000000000
Binary files a/.git-crypt/keys/default/0/79BD02F25334F112CF8B5CC9BA44BA8341537357.gpg and /dev/null differ
diff --git a/.git-crypt/keys/default/0/A67E5FD880EB089F2317796780D83A796103BF59.gpg b/.git-crypt/keys/default/0/A67E5FD880EB089F2317796780D83A796103BF59.gpg
deleted file mode 100644
index 61fc01395..000000000
Binary files a/.git-crypt/keys/default/0/A67E5FD880EB089F2317796780D83A796103BF59.gpg and /dev/null differ
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 83835e2e1..57315bc10 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,7 +6,6 @@ updates:
       interval: daily
     labels:
       - "area/dependency"
-      - "release-note-none"
       - "ok-to-test"
     open-pull-requests-limit: 10
 
@@ -16,6 +15,5 @@ updates:
       interval: daily
     labels:
       - "area/dependency"
-      - "release-note-none"
       - "ok-to-test"
     open-pull-requests-limit: 10
diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
new file mode 100644
index 000000000..df6234e23
--- /dev/null
+++ b/.github/workflows/build-image.yml
@@ -0,0 +1,74 @@
+name: Build and push image
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/build-image.yml
+      - Dockerfile
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version: v1.24.5
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Login to GHCR
+        if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate image metadata
+        id: meta
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
+            type=ref,event=tag
+            type=sha
+
+      - name: Build project
+        run: 'make build'
+
+      - name: Build and push image
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: .
+          file: ./Dockerfile
+          push: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index f04d8f11b..8e768ab1d 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -4,7 +4,6 @@ on:
   pull_request:
   push:
     branches:
-      - main
       - master
 
 jobs:
@@ -12,11 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
-          go-version: '1.22'
-          check-latest: true
+          go-version: v1.24.5
       - name: golangci-lint
         uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
-          version: v2.1
+          version: v2.5
diff --git a/.golangci.yml b/.golangci.yml
index b83e318b9..05f629dcc 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -49,7 +49,7 @@ linters:
     - musttag
     - nakedret
     - nilerr
-    - noctx
+    # - noctx
     - nolintlint
     - nosprintfhostport
     - prealloc
diff --git a/.prow.yaml b/.prow.yaml
new file mode 100644
index 000000000..3def1c085
--- /dev/null
+++ b/.prow.yaml
@@ -0,0 +1,99 @@
+presubmits:
+  - name: pull-publishing-bot-build
+    always_run: true
+    decorate: true
+    # This is a fork of k8s.io/publishing-bot so we keep the same path_alias
+    path_alias: k8s.io/publishing-bot
+    spec:
+      containers:
+      - image: ghcr.io/kcp-dev/infra/build:1.24.5-1
+        command:
+        - make
+        resources:
+          limits:
+            cpu: 2
+            memory: 4Gi
+          requests:
+            cpu: 2
+            memory: 4Gi
+  - name: pull-publishing-bot-test
+    always_run: true
+    decorate: true
+    path_alias: k8s.io/publishing-bot
+    spec:
+      containers:
+      - image: ghcr.io/kcp-dev/infra/build:1.24.5-1
+        command:
+        - make
+        - test
+        resources:
+          limits:
+            cpu: 2
+            memory: 4Gi
+          requests:
+            cpu: 2
+            memory: 4Gi
+  - name: pull-publishing-bot-validate-rules
+    # TODO: change to true after rules are in place
+    always_run: false
+    decorate: true
+    path_alias: k8s.io/publishing-bot
+    extra_refs:
+    - org: kcp-dev
+      repo: kcp
+      base_ref: main
+    spec:
+      containers:
+      - image: ghcr.io/kcp-dev/infra/build:1.24.5-1
+        env:
+        - name: "GOWORK"
+          value: "off"
+        command:
+        - go
+        args:
+        - run
+        - -mod=mod
+        - k8s.io/publishing-bot/cmd/validate-rules
+        - /home/prow/go/src/k8s.io/kubernetes/staging/publishing/rules.yaml
+        resources:
+          limits:
+            cpu: 2
+            memory: 4Gi
+          requests:
+            cpu: 2
+            memory: 4Gi
+  # TODO: Enable this job after publishing-bot is deployed to kcp-dev/kcp
+  # - name: pull-publishing-bot-test-kubernetes-master
+  #   cluster: eks-prow-build-cluster
+  #   always_run: false
+  #   decorate: true
+  #   decoration_config:
+  #     timeout: 3h
+  #   annotations:
+  #     testgrid-dashboards: sig-release-publishing-bot
+  #     testgrid-tab-name: pull-publishing-bot-test-k8s-master
+  #     description: test publishing bot against k/k master
+  #   labels:
+  #     preset-dind-enabled: "true"
+  #   path_alias: k8s.io/publishing-bot
+  #   spec:
+  #     containers:
+  #       - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250925-95b5a2c7a5-master
+  #         command:
+  #           - runner.sh
+  #         args:
+  #           - bash
+  #           - -ce
+  #           - |
+  #             make build-image
+  #             test/k8s-gen-bot-config.sh k8s-bot-config
+  #             test/run-bot-local.sh k8s-bot-config
+  #         securityContext:
+  #           privileged: true
+  #         resources:
+  #           requests:
+  #             cpu: 2
+  #             memory: 2Gi
+  #           limits:
+  #             cpu: 2
+  #             memory: 2Gi
diff --git a/Dockerfile b/Dockerfile
index 0ae0e9b72..94ba28dbf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,8 +23,8 @@ RUN apt-get update \
 ENV GOPATH="/go-workspace"
 ENV GOROOT="/go-workspace/go"
 ENV PATH="${GOPATH}/bin:/go-workspace/go/bin:${PATH}"
-ENV GIT_COMMITTER_NAME="Kubernetes Publisher"
-ENV GIT_COMMITTER_EMAIL="k8s-publishing-bot@users.noreply.github.com"
+ENV GIT_COMMITTER_NAME="kcp CI Bot"
+ENV GIT_COMMITTER_EMAIL="kcp-ci-bot@xrstf.de"
 ENV TERM=xterm
 ENV PS1='\h:\w\$'
 ENV SHELL=/bin/bash
diff --git a/Makefile b/Makefile
index 5fa083405..88635c468 100644
--- a/Makefile
+++ b/Makefile
@@ -21,8 +21,8 @@ all: build
 GIT_TAG ?= $(shell git describe --tags --always --dirty)
 
 # Image variables
-IMG_REGISTRY ?= gcr.io/k8s-staging-publishing-bot
-IMG_NAME = k8s-publishing-bot
+IMG_REGISTRY ?= ghcr.io/kcp-dev
+IMG_NAME = publishing-bot
 
 IMG_VERSION ?= v0.0.0-2
 
@@ -37,6 +37,7 @@ CPU_LIMITS ?= 2
 CPU_REQUESTS ?= 300m
 MEMORY_REQUESTS ?= 200Mi
 MEMORY_LIMITS ?= 1639Mi
+STORAGE_CLASS ?= ebs-sc
 GOOS ?= linux
 
 build_cmd = mkdir -p _output && GOOS=$(GOOS) CGO_ENABLED=0 go build -o _output/$(1) ./cmd/$(1)
@@ -65,6 +66,7 @@ push-image:
 	docker push $(DOCKER_REPO):$(GIT_TAG)
 	docker push $(DOCKER_REPO):$(IMG_VERSION)
 	docker push $(DOCKER_REPO):latest
+.PHONY: push-image
 
 build-and-push-image: build-image push-image
 .PHONY: build-and-push-image
@@ -89,21 +91,25 @@ init-deploy: validate
 	$(KUBECTL) delete -n "$(NAMESPACE)" --ignore-not-found=true replicaset publisher
 	$(KUBECTL) delete -n "$(NAMESPACE)" --ignore-not-found=true pod publisher
 	while $(KUBECTL) get pod -n "$(NAMESPACE)" publisher -a &>/dev/null; do echo -n .; sleep 1; done
-	$(KUBECTL) apply -n "$(NAMESPACE)" -f artifacts/manifests/storage-class.yaml || true
-	$(KUBECTL) get StorageClass ssd
+	$(KUBECTL) get StorageClass "$(STORAGE_CLASS)"
 	$(KUBECTL) apply -n "$(NAMESPACE)" -f $(CONFIG)-configmap.yaml
-	$(KUBECTL) apply -n "$(NAMESPACE)" -f $(CONFIG)-rules-configmap.yaml; \
-	$(KUBECTL) apply -n "$(NAMESPACE)" -f artifacts/manifests/pvc.yaml
+	$(KUBECTL) apply -n "$(NAMESPACE)" -f $(CONFIG)-rules-configmap.yaml
+	{ cat artifacts/manifests/pvc.yaml && sed 's,SC_NAME,$(STORAGE_CLASS),g' artifacts/manifests/pvc.yaml; } | \
+	$(KUBECTL) apply -f -
+.PHONY: init-deploy
 
 run: init-deploy
 	{ cat artifacts/manifests/pod.yaml && sed 's/^/  /' artifacts/manifests/podspec.yaml; } | \
 	$(call prepare_spec) | $(KUBECTL) apply -n "$(NAMESPACE)" -f -
+.PHONY: run
 
 deploy: init-deploy
 	$(KUBECTL) apply -n "$(NAMESPACE)" -f artifacts/manifests/service.yaml
 	{ cat artifacts/manifests/rs.yaml && sed 's/^/      /' artifacts/manifests/podspec.yaml; } | \
 	$(call prepare_spec) | sed 's/-interval=0/-interval=$(INTERVAL)/g' | \
 	$(KUBECTL) apply -n "$(NAMESPACE)" -f -
+.PHONY: deploy
 
 test: ## Run go tests
 	go test -v -coverprofile=coverage.out ./...
+.PHONY: test
diff --git a/OWNERS b/OWNERS
index f2c6f91a9..99dd51447 100644
--- a/OWNERS
+++ b/OWNERS
@@ -1,11 +1,7 @@
 approvers:
-  - sig-release-leads
-  - release-engineering-approvers
-  - dims
-  - nikhita
+  - clubanderson
+  - embik
+  - mjudeikis
+  - scheeles
   - sttts
-reviewers:
-  - release-engineering-reviewers
-  - akhilerm
-emeritus_approvers:
-  - caesarxuchao
+  - xrstf
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
deleted file mode 100644
index 12ed34b21..000000000
--- a/OWNERS_ALIASES
+++ /dev/null
@@ -1,25 +0,0 @@
-# See the OWNERS docs at https://go.k8s.io/owners#owners_aliases
-
-aliases:
-  sig-release-leads:
-    - cpanato # SIG Technical Lead
-    - jeremyrickard # SIG Chair
-    - justaugustus # SIG Chair
-    - puerco # SIG Technical Lead
-    - saschagrunert # SIG Chair
-    - Verolop # SIG Technical Lead
-  release-engineering-approvers:
-    - cpanato # subproject owner / Release Manager
-    - jeremyrickard # subproject owner / Release Manager
-    - justaugustus # subproject owner / Release Manager
-    - palnabarun # Release Manager
-    - puerco # subproject owner / Release Manager
-    - saschagrunert # subproject owner / Release Manager
-    - xmudrii # Release Manager
-    - Verolop # subproject owner / Release Manager
-  release-engineering-reviewers:
-    - ameukam # Release Manager Associate
-    - cici37 # Release Manager Associate
-    - jimangel # Release Manager Associate
-    - jrsapi # Release Manager Associate
-    - salaxander # Release Manager Associate
diff --git a/README.md b/README.md
index 8d8144364..10d67fe3d 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,13 @@
+> [!IMPORTANT]
+> This is a fork of the [Kubernetes publishing-bot project](https://github.com/kubernetes/publishing-bot).
+>
+> The reason for this fork is that the upstream publishing-bot project has a lot of hardcoded values that are
+> not compatible with kcp. These hardcoded values are project-specific, so the only option was to fork the
+> project and change these values to make it compatible with kcp and its infrastructure.
+>
+> For any inquires, see [our web page](https://docs.kcp.io/kcp/main/#getting-in-touch) for information on how to
+> get in touch with us.
+
 # Kubernetes Publishing Bot
 
 [![sig-release-publishing-bot/build](https://testgrid.k8s.io/q/summary/sig-release-publishing-bot/build/tests_status?style=svg)](https://testgrid.k8s.io/sig-release-publishing-bot#build)
diff --git a/artifacts/manifests/cronjob.yaml b/artifacts/manifests/cronjob.yaml
index 09ede2df8..56ae8c322 100644
--- a/artifacts/manifests/cronjob.yaml
+++ b/artifacts/manifests/cronjob.yaml
@@ -1,4 +1,4 @@
-apiVersion: batch/v1beta1
+apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: publisher
diff --git a/artifacts/manifests/pvc.yaml b/artifacts/manifests/pvc.yaml
index 6867638ed..6d1dd3842 100644
--- a/artifacts/manifests/pvc.yaml
+++ b/artifacts/manifests/pvc.yaml
@@ -10,4 +10,4 @@ spec:
   resources:
     requests:
       storage: 100Gi
-  storageClassName: ssd
+  storageClassName: "SC_NAME"
diff --git a/artifacts/manifests/storage-class.yaml b/artifacts/manifests/storage-class.yaml
deleted file mode 100644
index a87cca26a..000000000
--- a/artifacts/manifests/storage-class.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-kind: StorageClass
-apiVersion: storage.k8s.io/v1
-metadata:
-  name: ssd
-provisioner: kubernetes.io/gce-pd
-parameters:
-  type: pd-ssd
diff --git a/artifacts/scripts/construct.sh b/artifacts/scripts/construct.sh
index 939987ebe..72e3f5d4c 100755
--- a/artifacts/scripts/construct.sh
+++ b/artifacts/scripts/construct.sh
@@ -37,8 +37,8 @@ set -o nounset
 set -o pipefail
 set -o xtrace
 
-if [ ! $# -eq 15 ]; then
-    echo "usage: $0 repo src_branch dst_branch dependent_k8s.io_repos required_packages kubernetes_remote subdirectories source_repo_org source_repo_name base_package is_library recursive_delete_pattern skip_tags last_published_upstream_hash git_default_branch"
+if [ ! $# -eq 17 ]; then
+    echo "usage: $0 repo src_branch dst_branch dependent_k8s.io_repos required_packages kubernetes_remote subdirectories source_repo_org source_repo_name base_package is_library recursive_delete_pattern skip_tags skip_non_semver_tags semver_tags_base last_published_upstream_hash git_default_branch"
     exit 1
 fi
 
@@ -72,12 +72,16 @@ IS_LIBRARY="${2}"
 RECURSIVE_DELETE_PATTERN="${3}"
 # Skip syncing tags
 SKIP_TAGS="${4}"
+# Skip tags that do not start with 'v'
+SKIP_NON_SEMVER_TAGS="${5}"
+# Major version to use for building the tag (e.g. v1, v2...)
+SEMVER_TAGS_BASE="${6}"
 # last published upstream hash of this branch
-LAST_PUBLISHED_UPSTREAM_HASH="${5}"
+LAST_PUBLISHED_UPSTREAM_HASH="${7}"
 # name of the main branch. master for k8s.io/kubernetes
-GIT_DEFAULT_BRANCH="${6}"
+GIT_DEFAULT_BRANCH="${8}"
 
-readonly REPO SRC_BRANCH DST_BRANCH DEPS REQUIRED SOURCE_REMOTE SOURCE_REPO_ORG SUBDIRS SOURCE_REPO_NAME BASE_PACKAGE IS_LIBRARY RECURSIVE_DELETE_PATTERN SKIP_TAGS LAST_PUBLISHED_UPSTREAM_HASH GIT_DEFAULT_BRANCH
+readonly REPO SRC_BRANCH DST_BRANCH DEPS REQUIRED SOURCE_REMOTE SOURCE_REPO_ORG SUBDIRS SOURCE_REPO_NAME BASE_PACKAGE IS_LIBRARY RECURSIVE_DELETE_PATTERN SKIP_TAGS SKIP_NON_SEMVER_TAGS SEMVER_TAGS_BASE LAST_PUBLISHED_UPSTREAM_HASH GIT_DEFAULT_BRANCH
 
 SCRIPT_DIR=$(dirname "${BASH_SOURCE}")
 source "${SCRIPT_DIR}"/util.sh
@@ -177,7 +181,9 @@ if [ -z "${SKIP_TAGS}" ]; then
                --push-script ${PUSH_SCRIPT} \
                --dependencies "${DEPS}" \
                --mapping-output-file "../tag-${REPO}-{{.Tag}}-mapping" \
-               --publish-v0-semver \
+               --publish-semver-tags \
+               --skip-non-semver-tags="${SKIP_NON_SEMVER_TAGS}" \
+               --semver-tags-base "${SEMVER_TAGS_BASE}" \
                -alsologtostderr \
                "${EXTRA_ARGS[@]-}"
     if [ "${LAST_HEAD}" != "$(git rev-parse ${LAST_BRANCH})" ]; then
diff --git a/artifacts/scripts/util.sh b/artifacts/scripts/util.sh
index 406a9b5d5..6eda3f912 100755
--- a/artifacts/scripts/util.sh
+++ b/artifacts/scripts/util.sh
@@ -171,7 +171,7 @@ sync_repo() {
     local f_mainline_commits=""
     if [ "${new_branch}" = "true" ] && [ "${src_branch}" = "${git_default_branch}" ]; then
         # new master branch
-        filter-branch "${commit_msg_tag}" "${subdirectories}" "${recursive_delete_pattern}" ${src_branch} filtered-branch
+        filter-branch "${commit_msg_tag}" "${subdirectories}" "${recursive_delete_pattern}" "upstream/${src_branch}" filtered-branch
 
         # find commits on the main line (will mostly be merges, but could be non-merges if filter-branch dropped
         # the corresponding fast-forward merge and left the feature branch commits)
@@ -827,9 +827,16 @@ update-deps-in-gomod() {
     for (( i=0; i<${dep_count}; i++ )); do
         local dep="${deps_array[i]%%:*}"
         local dep_commit=$(cd ../${dep}; gomod-pseudo-version)
-        echo "Updating ${base_package}/${dep} to point to ${dep_commit}"
-        GO111MODULE=on go mod edit -fmt -require "${base_package}/${dep}@${dep_commit}"
-        GO111MODULE=on go mod edit -fmt -replace "${base_package}/${dep}=${base_package}/${dep}@${dep_commit}"
+        local mod_major=$(cd ../${dep}; gomod-module-major)
+        local go_pkg="${base_package}/${dep}"
+
+        if [ "${mod_major}" != "v0" ] && [ "${mod_major}" != "v1" ]; then
+            go_pkg="${go_pkg}/${mod_major}"
+        fi
+
+        echo "Updating ${go_pkg} to point to ${dep_commit}"
+        GO111MODULE=on go mod edit -fmt -require "${go_pkg}@${dep_commit}"
+        GO111MODULE=on go mod edit -fmt -replace "${go_pkg}=${go_pkg}@${dep_commit}"
     done
 
     GO111MODULE=on go mod edit -json | jq -r '.Replace[]? | select(.New.Path | startswith("../")) | "-dropreplace \(.Old.Path)"' | GO111MODULE=on xargs -L 100 go mod edit -fmt
@@ -880,8 +887,83 @@ update-deps-in-gomod() {
     ensure-clean-working-dir
 }
 
+# Reads the module major version from go.mod.
+# If no major version suffix is found, returns "v0".
+gomod-module-major() {
+    grep '^module ' go.mod | sed -E 's|^module .*/(v[0-9]+)$|\1|; t; s|.*|v0|'
+}
+
 gomod-pseudo-version() {
-    TZ=GMT git show -q --pretty='format:v0.0.0-%cd-%h' --date='format-local:%Y%m%d%H%M%S' --abbrev=12
+    local commit_sha
+    commit_sha="$(git rev-parse --short=12 HEAD)"
+    
+    local commit_ts
+    commit_ts="$(TZ=UTC git show -s --date='format-local:%Y%m%d%H%M%S' --format=%cd HEAD)"
+    
+    # Get tag pointing at HEAD (the current commit), if any
+    local commit_tag
+    commit_tag="$(git tag --points-at HEAD 2>/dev/null || true)"
+
+    # We assume that tags will always be valid semver tags starting with 'v'.
+    # Repositories cloned by the publishing-bot always have two remotes:
+    #   - origin: the published repository (e.g. github.com/kcp-dev/apimachinery)
+    #   - upstream: the local source repository (e.g. ../kcp)
+    # We only consider tags from the published repository (origin).
+    # Technically, we should never ever hit this case. That's because tags are synced
+    # only after the initial publishing is done. We might eventually hit this case if
+    # there are two different tags/versions on the same commit.
+    if [[ -n "${commit_tag:-}" ]]; then
+        commit_tag=$(echo "${commit_tag}" | grep 'origin\/v' | sed 's|^origin/||' | sort -V | tail -n1)
+        echo "${commit_tag}"
+        return
+    fi
+  
+    # Get the latest tag from the published repository (origin).
+    # This tag does not point at HEAD, otherwise the previous case would handle it.
+    local latest_tag
+    latest_tag="$(git ls-remote --tags origin 2>/dev/null || true)"
+
+    if [[ -z "${latest_tag:-}" ]]; then
+        # No tag exists, generate and return a pseudo-version string.
+        echo "v0.0.0-${commit_ts}-${commit_sha}"
+        return
+    fi
+
+    # "git ls-remote" returns a bit more data than needed, so we parse it take valid semver tag.
+    latest_tag="$(echo "${latest_tag}" | awk -F/ '{print $3}' | grep -v '\^{}' | grep 'v' | sort -V | tail -n1)"
+
+    # This returns the module major version as defined in go.mod.
+    local module_major
+    module_major="$(gomod-module-major)"
+
+    # Parse the latest tag and determine the semver elements.
+    if [[ "$latest_tag" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)(-.+)?$ ]]; then
+        local major="${BASH_REMATCH[1]}"
+        local minor="${BASH_REMATCH[2]}"
+        local patch="${BASH_REMATCH[3]}"
+        local pre="${BASH_REMATCH[4]}"
+
+        # If the module's major version matches the latest tag's major version.
+        if [[ "$module_major" == "v$major" ]]; then
+            if [[ -z "${pre}" ]]; then
+                # Stable tags are handled by incrementing the patch version
+                # and appending the pseudo-version suffix.
+                echo "v${major}.${minor}.$((patch+1))-0.${commit_ts}-${commit_sha}"
+            else
+                # Pre-release tags are handled by appending the pseudo-version suffix
+                # to the pre-release tag.
+                echo "${latest_tag}.0.${commit_ts}-${commit_sha}"
+            fi
+        else
+            # Otherwise, Go handles this in a little strange way. It takes the latest tag
+            # and appends "+incompatible" to it.
+            echo "${latest_tag}+incompatible"
+        fi
+    else
+        # If we hit this case, the latest tag is not a valid semver tag.
+        # We just generate v0.0.0 pseudo-version string instead.
+        echo "v0.0.0-${commit_ts}-${commit_sha}"
+    fi
 }
 
 # checkout the dependencies to the versions corresponding to the kube commit of HEAD
@@ -927,7 +1009,12 @@ checkout-deps-to-kube-commit() {
             git checkout -q "${dep_commit}"
 
             local pseudo_version=$(gomod-pseudo-version)
+            local mod_major=$(gomod-module-major)
             local cache_dir="${GOPATH}/pkg/mod/cache/download/${base_package}/${dep}/@v"
+            if [ "${mod_major}" != "v0" ] && [ "${mod_major}" != "v1" ]; then
+                cache_dir="${GOPATH}/pkg/mod/cache/download/${base_package}/${dep}/@v/${mod_major}"
+            fi
+            
             if [ -f "${cache_dir}/list" ] && grep -q "${pseudo_version}" "${cache_dir}/list"; then
             	echo "Pseudo version ${pseudo_version} is already packaged up."
             else
diff --git a/cmd/gomod-zip/zip.go b/cmd/gomod-zip/zip.go
index e0dbd6bc3..0d6a20b53 100644
--- a/cmd/gomod-zip/zip.go
+++ b/cmd/gomod-zip/zip.go
@@ -24,7 +24,9 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
 
+	"github.com/blang/semver/v4"
 	"github.com/golang/glog"
 	"golang.org/x/mod/modfile"
 	modzip "golang.org/x/mod/zip"
@@ -62,8 +64,16 @@ func main() {
 		glog.Fatalf("pseudo-version cannot be empty")
 	}
 
+	pseudoSemver, err := semver.Parse(strings.TrimPrefix(*pseudoVersion, "v"))
+	if err != nil {
+		glog.Fatalf("error parsing pseudo-version: %v", err)
+	}
+
 	packagePath := fmt.Sprintf("%s/src/%s", os.Getenv("GOPATH"), *packageName)
 	cacheDir := fmt.Sprintf("%s/pkg/mod/cache/download/%s/@v", os.Getenv("GOPATH"), *packageName)
+	if pseudoSemver.Major >= 2 {
+		cacheDir = fmt.Sprintf("%s/v%d", cacheDir, pseudoSemver.Major)
+	}
 
 	moduleFile, err := getModuleFile(packagePath, *pseudoVersion)
 	if err != nil {
diff --git a/cmd/publishing-bot/config/rules.go b/cmd/publishing-bot/config/rules.go
index fae1a69fd..5d570ad28 100644
--- a/cmd/publishing-bot/config/rules.go
+++ b/cmd/publishing-bot/config/rules.go
@@ -73,6 +73,8 @@ type BranchRule struct {
 type RepositoryRule struct {
 	DestinationRepository string       `yaml:"destination"`
 	Branches              []BranchRule `yaml:"branches"`
+	// the value to use as vX in vX.Y.Z published at the destination repo
+	DestinationTagBase string `yaml:"destination-tag-base,omitempty"`
 	// SmokeTest applies to all branches
 	SmokeTest string `yaml:"smoke-test,omitempty"` // a multiline bash script
 	Library   bool   `yaml:"library,omitempty"`
@@ -81,10 +83,13 @@ type RepositoryRule struct {
 }
 
 type RepositoryRules struct {
-	SkippedSourceBranches []string         `yaml:"skip-source-branches,omitempty"`
-	SkipGomod             bool             `yaml:"skip-gomod,omitempty"`
-	SkipTags              bool             `yaml:"skip-tags,omitempty"`
-	Rules                 []RepositoryRule `yaml:"rules"`
+	SkippedSourceBranches []string `yaml:"skip-source-branches,omitempty"`
+	SkipGomod             bool     `yaml:"skip-gomod,omitempty"`
+	SkipTags              bool     `yaml:"skip-tags,omitempty"`
+	// this skips tags in the source repo that are not valid semver tags
+	// e.g. v1.2.3 is valid, but <prefix>/v1.2.3 is not valid.
+	SkipNonSemverTags bool             `yaml:"skip-non-semver-tags,omitempty"`
+	Rules             []RepositoryRule `yaml:"rules"`
 
 	// ls-files patterns like: */BUILD *.ext pkg/foo.go Makefile
 	RecursiveDeletePatterns []string `yaml:"recursive-delete-patterns"`
diff --git a/cmd/publishing-bot/publisher.go b/cmd/publishing-bot/publisher.go
index e643a32c1..765afb544 100644
--- a/cmd/publishing-bot/publisher.go
+++ b/cmd/publishing-bot/publisher.go
@@ -292,6 +292,12 @@ func (p *PublisherMunger) construct() error {
 				p.plog.Infof("synchronizing tags is disabled")
 			}
 
+			skipNonSemverTags := "false"
+			if p.reposRules.SkipNonSemverTags {
+				skipNonSemverTags = "true"
+				p.plog.Infof("synchronizing non-semver tags is disabled")
+			}
+
 			// get old published hash to eventually skip cherry picking
 			var lastPublishedUpstreamHash string
 			bs, err := os.ReadFile(path.Join(p.baseRepoPath, publishedFileName(repoRule.DestinationRepository, branchRule.Name)))
@@ -318,6 +324,8 @@ func (p *PublisherMunger) construct() error {
 				strconv.FormatBool(repoRule.Library),
 				strings.Join(p.reposRules.RecursiveDeletePatterns, " "),
 				skipTags,
+				skipNonSemverTags,
+				repoRule.DestinationTagBase,
 				lastPublishedUpstreamHash,
 				p.config.GitDefaultBranch,
 			)
diff --git a/cmd/sync-tags/gomod.go b/cmd/sync-tags/gomod.go
index e9d41dfb8..0ece96276 100644
--- a/cmd/sync-tags/gomod.go
+++ b/cmd/sync-tags/gomod.go
@@ -27,6 +27,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/blang/semver/v4"
 	gogit "github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing"
 )
@@ -61,6 +62,8 @@ func updateGomodWithTaggedDependencies(tag string, depsRepo []string, semverTag
 		rev := commit.String()
 		pseudoVersionOrTag := fmt.Sprintf("v0.0.0-%s-%s", commitTime.UTC().Format("20060102150405"), rev[:12])
 
+		// TODO(xmudrii): We are configured to always hit this case because we have --publish-semver-tags set to true,
+		// so pseudo-version is not important. At some point, it would be nice to fix this.
 		if semverTag {
 			pseudoVersionOrTag = tag
 		}
@@ -153,7 +156,16 @@ type ModuleInfo struct {
 }
 
 func packageDepToGoModCache(depPath, depPkg, commit, pseudoVersionOrTag string, commitTime time.Time) error {
+	pseudoSemver, err := semver.Parse(strings.TrimPrefix(pseudoVersionOrTag, "v"))
+	if err != nil {
+		return fmt.Errorf("error parsing pseudo-version: %w", err)
+	}
+
 	cacheDir := fmt.Sprintf("%s/pkg/mod/cache/download/%s/@v", os.Getenv("GOPATH"), depPkg)
+	if pseudoSemver.Major >= 2 {
+		cacheDir = fmt.Sprintf("%s/v%d", cacheDir, pseudoSemver.Major)
+	}
+
 	goModFile := fmt.Sprintf("%s/%s.mod", cacheDir, pseudoVersionOrTag)
 
 	if _, err := os.Stat(goModFile); err == nil {
diff --git a/cmd/sync-tags/main.go b/cmd/sync-tags/main.go
index 7b261c3e4..1725c68be 100644
--- a/cmd/sync-tags/main.go
+++ b/cmd/sync-tags/main.go
@@ -24,6 +24,7 @@ import (
 	"io"
 	"os"
 	"os/exec"
+	"regexp"
 	"strings"
 	"text/template"
 	"time"
@@ -78,7 +79,10 @@ func main() {
 	dependencies := flag.String("dependencies", "", "comma-separated list of repo:branch pairs of dependencies")
 	skipFetch := flag.Bool("skip-fetch", false, "skip fetching tags")
 	mappingOutputFile := flag.String("mapping-output-file", "", "a file name to write the source->dest hash mapping to ({{.Tag}} is substituted with the tag name, {{.Branch}} with the local branch name)")
-	publishSemverTags := flag.Bool("publish-v0-semver", false, "publish v0.x.y tag at destination repo for v1.x.y tag at the source repo")
+	publishV0Semver := flag.Bool("publish-v0-semver", false, "publish v0.x.y tag at destination repo for v1.x.y tag at the source repo")
+	publishSemverTags := flag.Bool("publish-semver-tags", false, "publish vX.Y.Z tag at destination repo for vX.Y.Z tag at the source repo")
+	skipNonSemverTags := flag.Bool("skip-non-semver-tags", false, "skip non-semver tags at the source repo")
+	semverTagsBase := flag.String("semver-tags-base", "v0", "the value to use as vX in vX.Y.Z published at the destination repo")
 
 	flag.Usage = Usage
 	flag.Parse()
@@ -91,6 +95,10 @@ func main() {
 		glog.Fatalf("source-branch cannot be empty")
 	}
 
+	if *publishV0Semver && *publishSemverTags {
+		glog.Fatalf("only one of publish-v0-semver and publish-semver-tags can be true")
+	}
+
 	var dependentRepos []string
 	if *dependencies != "" {
 		for _, pair := range strings.Split(*dependencies, ",") {
@@ -188,23 +196,37 @@ func main() {
 	// create or update tags from srcTagCommits as local tags with the given prefix
 	createdTags := []string{}
 	for name, kh := range srcTagCommits {
+		if *skipNonSemverTags {
+			if _, semverErr := semver.Parse(strings.TrimPrefix(name, "v")); semverErr != nil {
+				continue
+			}
+		}
+
 		bName := name
 		if *prefix != "" {
 			bName = *prefix + name[1:] // remove the v
 		}
 
 		var (
-			semverTag        = ""
-			publishSemverTag = false
+			semverTag          = ""
+			publishSemverTag   = false
+			versionPrefixRegex = regexp.MustCompile(`^v\d+\.`)
 		)
 		// if we are publishing semver tags
-		if *publishSemverTags {
+		if *publishV0Semver {
 			// and this is a valid v1... semver tag
 			if _, semverErr := semver.Parse(name[1:]); semverErr == nil && strings.HasPrefix(name, "v1.") {
 				publishSemverTag = true
 				semverTag = "v0." + strings.TrimPrefix(name, "v1.") // replace v1.x.y with v0.x.y
 			}
 		}
+		if *publishSemverTags {
+			// and this is a valid semver tag
+			if _, semverErr := semver.Parse(strings.TrimPrefix(name, "v")); semverErr == nil {
+				publishSemverTag = true
+				semverTag = *semverTagsBase + "." + versionPrefixRegex.ReplaceAllString(name, "")
+			}
+		}
 
 		// ignore non-annotated tags
 		tag, err := r.TagObject(kh)
@@ -234,7 +256,20 @@ func main() {
 				glog.Fatalf("Failed to get tag %s: %v", bName, err)
 			}
 			rev := commit.String()
+
+			pseudoSemver, err := semver.Parse(strings.TrimPrefix(name, "v"))
+			if err != nil {
+				glog.Fatalf("error parsing pseudo-version: %v", err)
+			}
+
 			pseudoVersion := fmt.Sprintf("v0.0.0-%s-%s", commitTime.UTC().Format("20060102150405"), rev[:12])
+			if pseudoSemver.Major >= 2 {
+				if len(pseudoSemver.Pre) == 0 {
+					pseudoVersion = fmt.Sprintf("v%d.%d.%d-0.%s-%s", pseudoSemver.Major, pseudoSemver.Minor, pseudoSemver.Patch+1, commitTime.UTC().Format("20060102150405"), rev[:12])
+				} else {
+					pseudoVersion = fmt.Sprintf("v%s.0.%s-%s", strings.TrimPrefix(name, "v"), commitTime.UTC().Format("20060102150405"), rev[:12])
+				}
+			}
 
 			fmt.Printf("Clearing cache for local tag %s.\n", pseudoVersion)
 			if err := cleanCacheForTag(pseudoVersion); err != nil {
@@ -291,7 +326,7 @@ func main() {
 				fmt.Printf("Writing source->dest hash mapping to %q\n", fname)
 				f, err := os.Create(fname)
 				if err != nil {
-					glog.Fatal(f)
+					glog.Fatal(err)
 				}
 				if err := writeKubeCommitMapping(f, sourceCommitsToDstCommits, srcFirstParents); err != nil {
 					glog.Fatal(err)
@@ -331,9 +366,9 @@ func main() {
 		if publishSemverTag {
 			fmt.Printf("Tagging %v as %q.\n", bh, semverTag)
 			err = createAnnotatedTag(bh, semverTag, tag.Tagger.When, dedent.Dedent(fmt.Sprintf(`
-			Kubernetes release %s
+			kcp release %s
 
-			Based on https://github.com/kubernetes/kubernetes/releases/tag/%s
+			Based on https://github.com/kcp-dev/kcp/releases/tag/%s
 			`, name, name)))
 			if err != nil {
 				glog.Fatalf("Failed to create tag %q: %v", semverTag, err)
@@ -344,9 +379,9 @@ func main() {
 		// create non-semver prefixed annotated tag
 		fmt.Printf("Tagging %v as %q.\n", bh, bName)
 		err = createAnnotatedTag(bh, bName, tag.Tagger.When, dedent.Dedent(fmt.Sprintf(`
-				Kubernetes release %s
+				kcp release %s
 
-				Based on https://github.com/kubernetes/kubernetes/releases/tag/%s
+				Based on https://github.com/kcp-dev/kcp/releases/tag/%s
 				`, name, name)))
 		if err != nil {
 			glog.Fatalf("Failed to create tag %q: %v", bName, err)
@@ -545,7 +580,16 @@ func cleanCacheForTag(tag string) error {
 	if err != nil {
 		return fmt.Errorf("failed to get package at %s: %w", dir, err)
 	}
+
+	pseudoSemver, err := semver.Parse(strings.TrimPrefix(tag, "v"))
+	if err != nil {
+		return fmt.Errorf("error parsing pseudo-version: %w", err)
+	}
+
 	cacheDir := fmt.Sprintf("%s/pkg/mod/cache/download/%s/@v", os.Getenv("GOPATH"), pkg)
+	if pseudoSemver.Major >= 2 {
+		cacheDir = fmt.Sprintf("%s/v%d", cacheDir, pseudoSemver.Major)
+	}
 
 	goModFile := fmt.Sprintf("%s/%s.mod", cacheDir, tag)
 	if _, err := os.Stat(goModFile); err == nil {
diff --git a/configs/kubernetes b/configs/kcp-dev
similarity index 68%
rename from configs/kubernetes
rename to configs/kcp-dev
index fb61cc4d8..d739f7e75 100644
--- a/configs/kubernetes
+++ b/configs/kcp-dev
@@ -1,4 +1,4 @@
-DOCKER_REPO = gcr.io/k8s-staging-publishing-bot/k8s-publishing-bot
+DOCKER_REPO = ghcr.io/kcp-dev/publishing-bot
 NAMESPACE = publishing-bot
 SCHEDULE = * */4 * * *
 INTERVAL = 14400
diff --git a/configs/kcp-dev-configmap.yaml b/configs/kcp-dev-configmap.yaml
new file mode 100644
index 000000000..64dfce1f3
--- /dev/null
+++ b/configs/kcp-dev-configmap.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: publisher-config
+data:
+  config: |
+    source-org: kcp-dev
+    source-repo: kcp
+    target-org: kcp-dev
+    rules-file: https://raw.githubusercontent.com/kcp-dev/kcp/refs/heads/main/staging/publishing/rules.yaml
+    git-default-branch: main
+    github-issue: 3619
+    dry-run: false
diff --git a/configs/kubernetes-nightly-rules-configmap.yaml b/configs/kcp-dev-rules-configmap.yaml
similarity index 100%
rename from configs/kubernetes-nightly-rules-configmap.yaml
rename to configs/kcp-dev-rules-configmap.yaml
diff --git a/configs/kcp-nightly b/configs/kcp-nightly
new file mode 100644
index 000000000..6f3b304cd
--- /dev/null
+++ b/configs/kcp-nightly
@@ -0,0 +1,8 @@
+DOCKER_REPO = ghcr.io/kcp-dev/publishing-bot
+NAMESPACE = publishing-bot-nightly
+SCHEDULE = * */4 * * *
+INTERVAL = 14400
+CPU_LIMITS = 2
+CPU_REQUESTS = 300m
+MEMORY_REQUESTS = 2Gi
+MEMORY_LIMITS = 2Gi
diff --git a/configs/kcp-nightly-configmap.yaml b/configs/kcp-nightly-configmap.yaml
new file mode 100644
index 000000000..c6d700b26
--- /dev/null
+++ b/configs/kcp-nightly-configmap.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: publisher-config
+data:
+  config: |
+    source-org: kcp-nightly
+    source-repo: kcp
+    target-org: kcp-nightly
+    base-package: github.com/kcp-dev
+    rules-file: https://raw.githubusercontent.com/kcp-nightly/kcp/refs/heads/main/staging/publishing/rules.yaml
+    git-default-branch: main
+    github-issue: 1
+    dry-run: false
diff --git a/configs/kubernetes-rules-configmap.yaml b/configs/kcp-nightly-rules-configmap.yaml
similarity index 100%
rename from configs/kubernetes-rules-configmap.yaml
rename to configs/kcp-nightly-rules-configmap.yaml
diff --git a/configs/kubernetes-configmap.yaml b/configs/kubernetes-configmap.yaml
deleted file mode 100644
index ab11ed705..000000000
--- a/configs/kubernetes-configmap.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: publisher-config
-data:
-  config: |
-    source-org: kubernetes
-    source-repo: kubernetes
-    target-org: kubernetes
-    rules-file: https://raw.githubusercontent.com/kubernetes/kubernetes/master/staging/publishing/rules.yaml
-    github-issue: 56876
-    dry-run: false
diff --git a/configs/kubernetes-nightly b/configs/kubernetes-nightly
deleted file mode 100644
index fc0645b8e..000000000
--- a/configs/kubernetes-nightly
+++ /dev/null
@@ -1,6 +0,0 @@
-DOCKER_REPO = gcr.io/k8s-staging-publishing-bot/k8s-publishing-bot-nightly
-NAMESPACE = k8s-publishing-bot-nightly
-SCHEDULE = * */4 * * *
-INTERVAL = 14400
-MEMORY_REQUESTS = 2Gi
-MEMORY_LIMITS = 3Gi
diff --git a/configs/kubernetes-nightly-configmap.yaml b/configs/kubernetes-nightly-configmap.yaml
deleted file mode 100644
index dd5fc52f9..000000000
--- a/configs/kubernetes-nightly-configmap.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: publisher-config
-data:
-  config: |
-    source-org: kubernetes
-    source-repo: kubernetes
-    target-org: kubernetes-nightly
-    rules-file: https://raw.githubusercontent.com/kubernetes/kubernetes/master/staging/publishing/rules.yaml
-    github-issue: 1
-    dry-run: false
diff --git a/configs/kubernetes-nightly-token b/configs/kubernetes-nightly-token
deleted file mode 100644
index c62e5bd29..000000000
Binary files a/configs/kubernetes-nightly-token and /dev/null differ
diff --git a/configs/kubernetes-token b/configs/kubernetes-token
deleted file mode 100644
index c62e5bd29..000000000
Binary files a/configs/kubernetes-token and /dev/null differ
diff --git a/hack/create-repos.sh b/hack/create-repos.sh
index c5aa9a9cc..5d19db521 100755
--- a/hack/create-repos.sh
+++ b/hack/create-repos.sh
@@ -28,7 +28,7 @@ if [ "$#" = 0 ] || [ "$#" -gt 2 ]; then
     exit 1
 fi
 
-FROM="kubernetes"
+FROM="kcp-dev"
 TO="${1}"
 if [ "$#" -ge 2 ]; then
     FROM="${TO}"
@@ -39,8 +39,8 @@ GITHUB_HOST=${GITHUB_HOST:-github.com}
 repo_count=${#repos[@]}
 
 # safety check
-if [ "${TO}" = "kubernetes" ]; then
-    echo "Cannot operate on kubernetes directly" 1>&2
+if [ "${TO}" = "kcp-dev" ]; then
+    echo "Cannot operate on kcp-dev directly" 1>&2
     exit 1
 fi
 
@@ -69,6 +69,6 @@ for (( i=0; i<${repo_count}; i++ )); do
         echo "repository found: ${repos[i]}"
     else
         echo "repository not found: ${repos[i]}"
-        gh repo fork "kubernetes/${repos[i]}" --org "${TO}" --remote --clone=false
+        gh repo fork "kcp-dev/${repos[i]}" --org "${TO}" --remote --clone=false
     fi
 done
diff --git a/hack/fetch-all-latest-and-push.sh b/hack/fetch-all-latest-and-push.sh
index 97ecea891..7b7e604d6 100755
--- a/hack/fetch-all-latest-and-push.sh
+++ b/hack/fetch-all-latest-and-push.sh
@@ -25,7 +25,7 @@ if [ "$#" = 0 ] || [ "$#" -gt 2 ]; then
     exit 1
 fi
 
-FROM="kubernetes"
+FROM="kcp-dev"
 TO="${1}"
 if [ "$#" -ge 2 ]; then
     FROM="${TO}"
@@ -46,8 +46,8 @@ function delete() {
 trap delete EXIT INT
 
 # safety check
-if [ "${TO}" = "kubernetes" ]; then
-    echo "Cannot operate on kubernetes directly" 1>&2
+if [ "${TO}" = "kcp-dev" ]; then
+    echo "Cannot operate on kcp-dev directly" 1>&2
     exit 1
 fi
 
@@ -61,7 +61,7 @@ for (( i=0; i<${repo_count}; i++ )); do
 
     # delete all tags and branches in origin
     rm -f .git/refs/tags/*
-    branches=$(git branch -r | grep "^ *origin" | sed 's,^ *origin/,,' | grep -v HEAD | grep -v '^master' || true)
+    branches=$(git branch -r | grep "^ *origin" | sed 's,^ *origin/,,' | grep -v HEAD | grep -v '^master' | grep -v '^main' || true)
     tags=$(git tag | sed 's,^,refs/tags/,')
     if [ -n "${branches}${tags}" ]; then
         git push --atomic --delete origin ${branches} ${tags}
diff --git a/hack/repos.sh b/hack/repos.sh
index 01992750a..856190790 100644
--- a/hack/repos.sh
+++ b/hack/repos.sh
@@ -20,36 +20,7 @@ set -o pipefail
 
 # shellcheck disable=SC2034
 repos=(
-    api
-    apiextensions-apiserver
     apimachinery
-    apiserver
-    cli-runtime
     client-go
-    cloud-provider
-    cluster-bootstrap
     code-generator
-    component-base
-    component-helpers
-    controller-manager
-    cri-api
-    cri-client
-    csi-translation-lib
-    dynamic-resource-allocation
-    externaljwt
-    endpointslice
-    kms
-    kube-aggregator
-    kube-controller-manager
-    kube-proxy
-    kube-scheduler
-    kubectl
-    kubelet
-    legacy-cloud-providers
-    metrics
-    mount-utils
-    pod-security-admission
-    sample-apiserver
-    sample-cli-plugin
-    sample-controller
 )
diff --git a/hack/verify-golangci-lint.sh b/hack/verify-golangci-lint.sh
index 5ca7bc352..c9f2b0fd0 100755
--- a/hack/verify-golangci-lint.sh
+++ b/hack/verify-golangci-lint.sh
@@ -18,7 +18,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-VERSION=v1.55.2
+VERSION=v2.5.0
 URL_BASE=https://raw.githubusercontent.com/golangci/golangci-lint
 URL=$URL_BASE/$VERSION/install.sh
 
diff --git a/pkg/golang/install.go b/pkg/golang/install.go
index b504b83d9..7e3c636f6 100644
--- a/pkg/golang/install.go
+++ b/pkg/golang/install.go
@@ -21,6 +21,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 
 	"github.com/golang/glog"
@@ -95,7 +96,7 @@ func installGoVersion(v, pth string) error {
 	}
 	defer os.RemoveAll(tmpPath)
 
-	cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("curl -SLf https://storage.googleapis.com/golang/go%s.linux-amd64.tar.gz | tar -xz --strip 1 -C %s", v, tmpPath))
+	cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("curl -SLf https://storage.googleapis.com/golang/go%s.%s-%s.tar.gz | tar -xz --strip 1 -C %s", v, runtime.GOOS, runtime.GOARCH, tmpPath))
 	cmd.Dir = tmpPath
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/test/k8s-gen-bot-config.sh b/test/k8s-gen-bot-config.sh
index 12ad10e3a..a0dfa06cd 100755
--- a/test/k8s-gen-bot-config.sh
+++ b/test/k8s-gen-bot-config.sh
@@ -19,7 +19,7 @@ set -o nounset
 set -o pipefail
 set -o xtrace
 
-# This script generates the config and rules required for testing the master branch of k/k
+# This script generates the config and rules required for testing the main branch of kcp-dev/kcp
 # with publishing bot
 
 BOT_CONFIG_DIRECTORY="${1:-bot-configs}"
@@ -28,7 +28,7 @@ mkdir "${BOT_CONFIG_DIRECTORY}"
 
 ## generate the required config
 # use the content from configmap in the data section
-sed -e '1,/config: |/d' configs/kubernetes-configmap.yaml > "${BOT_CONFIG_DIRECTORY}"/config
+sed -e '1,/config: |/d' configs/kcp-dev-configmap.yaml > "${BOT_CONFIG_DIRECTORY}"/config
 # The additional .tmp extension is used after -i to make it portable across *BSD and GNU.
 #   Ref: https://unix.stackexchange.com/a/92907
 # Also \t is not recognized in non GNU sed implementation. Therefore a tab is used as is.
@@ -41,12 +41,12 @@ sed -i.tmp -e 's/dry-run: false/dry-run: true/g' "${BOT_CONFIG_DIRECTORY}"/confi
 
 ## generate the required rules
 # get the rules file from the k/k repo
-wget https://raw.githubusercontent.com/kubernetes/kubernetes/master/staging/publishing/rules.yaml -O "${BOT_CONFIG_DIRECTORY}"/rules
+wget https://raw.githubusercontent.com/kcp-dev/kcp/main/staging/publishing/rules.yaml -O "${BOT_CONFIG_DIRECTORY}"/rules
 # change permission so that yq container can make changes to the rules file
 chmod 666 "${BOT_CONFIG_DIRECTORY}"/rules
-# only work on master branch
-# yq is used to remove non master branch related rules
+# only work on main branch
+# yq is used to remove non main branch related rules
 docker run \
     --rm \
     -v "${PWD}/${BOT_CONFIG_DIRECTORY}":/workdir \
-    mikefarah/yq:4.32.2 -i 'del( .rules.[].branches.[] | select (.name != "master"))' rules
+    mikefarah/yq:4.32.2 -i 'del( .rules.[].branches.[] | select (.name != "main"))' rules
diff --git a/test/run-bot-local.sh b/test/run-bot-local.sh
index 49d120fe4..4d9a223fc 100755
--- a/test/run-bot-local.sh
+++ b/test/run-bot-local.sh
@@ -21,7 +21,7 @@ set -o xtrace
 
 # This script expects a config and rules file in the BOT_CONFIG_DIRECTORY which will be used for running
 # the publishing bot
-# The image gcr.io/k8s-staging-publishing-bot/k8s-publishing-bot:latest should be available locally
+# The image ghcr.io/kcp-dev/publishing-bot:latest should be available locally
 # in the docker daemon
 
 BOT_CONFIG_DIRECTORY="${1:-bot-configs}"
@@ -34,7 +34,7 @@ docker run --rm \
     -v local-go-workspace:/go-workspace \
     -v cache:/.cache \
     -v "${PWD}/${BOT_CONFIG_DIRECTORY}":/etc/bot-configs \
-    gcr.io/k8s-staging-publishing-bot/k8s-publishing-bot:latest \
+    ghcr.io/kcp-dev/publishing-bot:latest \
     /init-repo \
         --alsologtostderr \
         --config=/etc/bot-configs/config \
@@ -45,7 +45,7 @@ docker run --rm \
     -v local-go-workspace:/go-workspace \
     -v cache:/.cache \
     -v "${PWD}/${BOT_CONFIG_DIRECTORY}":/etc/bot-configs \
-    gcr.io/k8s-staging-publishing-bot/k8s-publishing-bot:latest \
+    ghcr.io/kcp-dev/publishing-bot:latest \
     /publishing-bot \
         --alsologtostderr \
         --config=/etc/bot-configs/config \