diff --git a/doozer/doozerlib/cli/images_streams.py b/doozer/doozerlib/cli/images_streams.py
index e022bf2466..ce9be4ad4a 100644
--- a/doozer/doozerlib/cli/images_streams.py
+++ b/doozer/doozerlib/cli/images_streams.py
@@ -1466,8 +1466,10 @@ def resolve_upstream_from(runtime, image_entry):
             # In release payloads, images are promoted into an imagestream
             # tag name without the ose- prefix.
             image_name = remove_prefix(image_name, 'ose-')
-            # e.g. registry.ci.openshift.org/ocp/4.6:base
-            return f'registry.ci.openshift.org/ocp/{major}.{minor}:{image_name}'
+            # e.g. quay-proxy.ci.registry.openshift.org/ocp/4.6:base
+            # TODO: temporary workaround for a registry.ci.openshift.org migration;
+            # revisit switching this back once the migration is complete.
+            return f'quay-proxy.ci.registry.openshift.org/ocp/{major}.{minor}:{image_name}'
 
     if image_entry.image:
         # CI is on its own. We can't give them an image that isn't available outside the firewall.
diff --git a/doozer/tests/cli/test_images_streams.py b/doozer/tests/cli/test_images_streams.py
index 378cc5c7f9..040032a574 100644
--- a/doozer/tests/cli/test_images_streams.py
+++ b/doozer/tests/cli/test_images_streams.py
@@ -116,7 +116,7 @@ def test_resolve_upstream_from_with_member_using_heuristic(mocker, mock_runtime)
     result = images_streams.resolve_upstream_from(mock_runtime, image_entry)
 
     # Should strip 'ose-' prefix from image name
-    assert result == 'registry.ci.openshift.org/ocp/4.17:ansible'
+    assert result == 'quay-proxy.ci.registry.openshift.org/ocp/4.17:ansible'
 
 
 def test_resolve_upstream_from_with_member_using_payload_name(mocker, mock_runtime):
@@ -135,7 +135,7 @@ def test_resolve_upstream_from_with_member_using_payload_name(mocker, mock_runti
     result = images_streams.resolve_upstream_from(mock_runtime, image_entry)
 
     # Should use payload_name and strip path
-    assert result == 'registry.ci.openshift.org/ocp/4.18:custom-payload-name'
+    assert result == 'quay-proxy.ci.registry.openshift.org/ocp/4.18:custom-payload-name'
 
 
 def test_resolve_upstream_from_with_image_entry(mock_runtime):