diff --git a/src/main.test.ts b/src/main.test.ts
index c9f4f1c..bd55def 100644
--- a/src/main.test.ts
+++ b/src/main.test.ts
@@ -10,6 +10,7 @@ const originalPath = process.env.PATH;
 const originalNpmUserconfig = process.env.NPM_CONFIG_USERCONFIG;
 const originalRunnerTemp = process.env.RUNNER_TEMP;
 const originalWorkspace = process.env.GITHUB_WORKSPACE;
+const originalImageRegistry = process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY;
 const tempDirs = new Set<string>();
 let mainModule: typeof import("./main.ts") | null = null;
 
@@ -21,8 +22,21 @@ afterEach(() => {
   } else {
     process.env.NPM_CONFIG_USERCONFIG = originalNpmUserconfig;
   }
-  process.env.RUNNER_TEMP = originalRunnerTemp;
-  process.env.GITHUB_WORKSPACE = originalWorkspace;
+  if (originalRunnerTemp === undefined) {
+    delete process.env.RUNNER_TEMP;
+  } else {
+    process.env.RUNNER_TEMP = originalRunnerTemp;
+  }
+  if (originalWorkspace === undefined) {
+    delete process.env.GITHUB_WORKSPACE;
+  } else {
+    process.env.GITHUB_WORKSPACE = originalWorkspace;
+  }
+  if (originalImageRegistry === undefined) {
+    delete process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY;
+  } else {
+    process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY = originalImageRegistry;
+  }
   delete process.env.FAKE_CLI_VERSION;
   delete process.env.FAKE_NPM_BIN;
   delete process.env.FAKE_NPM_INTEGRITY;
@@ -743,6 +757,41 @@ test("explicit version overrides detected root lockfiles", async () => {
   expect(spies.setFailed).not.toHaveBeenCalled();
 });
 
+test("pins legacy installed CLI versions to GHCR", async () => {
+  installFakeNpm("supabase 2.107.0");
+  const spies = createActionSpies("2.107.0");
+  const { run } = await getMainModule();
+
+  await run();
+
+  expect(spies.exportVariable).toHaveBeenCalledWith(CLI_CONFIG_REGISTRY, "ghcr.io");
+  expect(spies.setFailed).not.toHaveBeenCalled();
+});
+
+test("uses the CLI registry fallback for installed versions that support it", async () => {
+  installFakeNpm("supabase 2.108.0");
+  const spies = createActionSpies("latest");
+  const { run } = await getMainModule();
+
+  await run();
+
+  expect(spies.exportVariable).not.toHaveBeenCalled();
+  expect(spies.setFailed).not.toHaveBeenCalled();
+});
+
+test("preserves an explicitly configured image registry for legacy CLI versions", async () => {
+  installFakeNpm("supabase 2.107.0");
+  process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY = "registry.example.test";
+  const spies = createActionSpies("2.107.0");
+  const { run } = await getMainModule();
+
+  await run();
+
+  expect(spies.exportVariable).not.toHaveBeenCalled();
+  expect(process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY).toBe("registry.example.test");
+  expect(spies.setFailed).not.toHaveBeenCalled();
+});
+
 test("fails when the installed CLI does not report a version", async () => {
   installFakeNpm("");
   process.env.GITHUB_WORKSPACE = createWorkspace({
diff --git a/src/main.ts b/src/main.ts
index dac8cc7..da3cc9a 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 
 export const CLI_CONFIG_REGISTRY = "SUPABASE_INTERNAL_IMAGE_REGISTRY";
 const REGISTRY_VERSION = "1.28.0";
+const FALLBACK_VERSION = "2.108.0";
 const DEFAULT_VERSION = "latest";
 const NPM_PACKAGE = "supabase";
 const NPM_EXECUTABLE_ENV = "SUPABASE_SETUP_CLI_NPM";
@@ -379,13 +380,13 @@ export async function determineInstalledVersion(cliPath: string): Promise<string
   return version;
 }
 
-function shouldUseGhcrRegistry(requestedVersion: string, installedVersion: string): boolean {
-  if (requestedVersion.toLowerCase() === DEFAULT_VERSION) {
-    return true;
-  }
-
+function shouldUseGhcrRegistry(installedVersion: string): boolean {
   const concreteVersion = extractConcreteVersion(installedVersion);
-  return concreteVersion !== null && semver.order(concreteVersion, REGISTRY_VERSION) >= 0;
+  return (
+    concreteVersion !== null &&
+    semver.order(concreteVersion, REGISTRY_VERSION) >= 0 &&
+    semver.order(concreteVersion, FALLBACK_VERSION) < 0
+  );
 }
 
 export async function run(): Promise<void> {
@@ -396,7 +397,7 @@ export async function run(): Promise<void> {
     core.setOutput("version", installedVersion);
     core.addPath(cliPath);
 
-    if (shouldUseGhcrRegistry(resolution.version, installedVersion)) {
+    if (shouldUseGhcrRegistry(installedVersion) && !process.env[CLI_CONFIG_REGISTRY]) {
       core.exportVariable(CLI_CONFIG_REGISTRY, "ghcr.io");
     }
   } catch (error) {