diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 01b814b..2c2e220 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -24,5 +24,20 @@ jobs:
         run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.ipao.vip --username "${{ gitea.actor }}" --password-stdin
       - name: Build image
         env:
+          OCI_REVISION: ${{ gitea.sha }}
+          OCI_SOURCE: https://git.ipao.vip/rogee/fingerprint-chromium
           PUSH: ${{ gitea.event_name != 'pull_request' }}
         run: ./scripts/build.sh git.ipao.vip/rogee/fingerprint-chromium
+      - name: Link package to repository
+        if: gitea.event_name != 'pull_request'
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          package_api=https://git.ipao.vip/api/v1/packages/rogee/container/fingerprint-chromium
+          linked_repo="$(curl --fail --silent --show-error --header "Authorization: token $REGISTRY_TOKEN" "$package_api/-/latest" | jq -r '.repository.full_name // empty')"
+          if [ "$linked_repo" != rogee/fingerprint-chromium ]; then
+            curl --fail --silent --show-error --request POST \
+              --header "Authorization: token $REGISTRY_TOKEN" \
+              "$package_api/-/link/fingerprint-chromium"
+          fi
+          test "$(curl --fail --silent --show-error --header "Authorization: token $REGISTRY_TOKEN" "$package_api/-/latest" | jq -r '.repository.full_name // empty')" = rogee/fingerprint-chromium
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b977b1b..784fb84 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -24,5 +24,7 @@ jobs:
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io --username "${{ github.actor }}" --password-stdin
       - name: Build image
         env:
+          OCI_REVISION: ${{ github.sha }}
+          OCI_SOURCE: https://github.com/rogeecn/fingerprint-chromium
           PUSH: ${{ github.event_name != 'pull_request' }}
         run: ./scripts/build.sh ghcr.io/rogeecn/fingerprint-chromium
diff --git a/Dockerfile b/Dockerfile
index 35cb4d8..18766b3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,8 +15,11 @@ RUN apt-get update \
 FROM ubuntu:24.04
 
 ARG CHROME_VERSION
+ARG OCI_REVISION
+ARG OCI_SOURCE
 
-LABEL org.opencontainers.image.source="https://github.com/adryfish/fingerprint-chromium" \
+LABEL org.opencontainers.image.revision="$OCI_REVISION" \
+      org.opencontainers.image.source="$OCI_SOURCE" \
       org.opencontainers.image.version="$CHROME_VERSION"
 
 RUN apt-get update \
diff --git a/scripts/build.sh b/scripts/build.sh
index 5dfda41..6ef5cc5 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -3,6 +3,8 @@ set -euo pipefail
 
 image="${1:-fingerprint-chromium}"
 release_api="https://api.github.com/repos/adryfish/fingerprint-chromium/releases"
+oci_revision="${OCI_REVISION:-$(git rev-parse HEAD)}"
+oci_source="${OCI_SOURCE:-https://git.ipao.vip/rogee/fingerprint-chromium}"
 
 if [[ -n "${CHROME_VERSION:-}" ]]; then
   release_url="$release_api/tags/$CHROME_VERSION"
@@ -21,6 +23,8 @@ tag="$image:$version"
 docker build --pull --platform linux/amd64 \
   --build-arg "CHROME_VERSION=$version" \
   --build-arg "CHROME_URL=$asset_url" \
+  --build-arg "OCI_REVISION=$oci_revision" \
+  --build-arg "OCI_SOURCE=$oci_source" \
   --tag "$tag" .
 
 if [[ "${PUSH:-false}" == "true" ]]; then
diff --git a/tests/check.sh b/tests/check.sh
index 7e8dc46..1288c79 100755
--- a/tests/check.sh
+++ b/tests/check.sh
@@ -12,3 +12,9 @@ grep -q 'git.ipao.vip/rogee/fingerprint-chromium' .gitea/workflows/publish.yml
 grep -q 'ghcr.io/rogeecn/fingerprint-chromium' .github/workflows/publish.yml
 grep -q 'packages: write' .gitea/workflows/publish.yml
 grep -q 'packages: write' .github/workflows/publish.yml
+grep -q 'org.opencontainers.image.revision="$OCI_REVISION"' Dockerfile
+grep -q 'org.opencontainers.image.source="$OCI_SOURCE"' Dockerfile
+grep -q 'OCI_SOURCE: https://git.ipao.vip/rogee/fingerprint-chromium' .gitea/workflows/publish.yml
+grep -q '/link/fingerprint-chromium' .gitea/workflows/publish.yml
+grep -q "repository.full_name // empty" .gitea/workflows/publish.yml
+test "$(grep -c 'Authorization: token \$REGISTRY_TOKEN' .gitea/workflows/publish.yml)" -eq 3