diff --git a/hack/pin-konflux-policy-bundle.sh b/hack/pin-konflux-policy-bundle.sh
index 74d25c36a..2f924811d 100755
--- a/hack/pin-konflux-policy-bundle.sh
+++ b/hack/pin-konflux-policy-bundle.sh
@@ -16,7 +16,10 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # This script resolves a policy configuration and replaces the release
-# policy OCI tag reference with a digest-pinned reference. It requires
+# policy OCI tag references with a digest-pinned reference. Both the
+# conforma repository and its enterprise-contract mirror are handled: the
+# release process retags both in the same step, so either reference
+# identifies the same policy image. It requires
 # the following environment variables:
 #
 # - POLICY_CONFIGURATION: Policy reference (k8s name, inline JSON, or file path).
@@ -75,25 +78,42 @@ else
   fi
 fi
 
-ORIGINAL="oci::quay.io/conforma/release-policy:konflux"
 REPLACEMENT="oci::quay.io/conforma/release-policy@${POLICY_BUNDLE_DIGEST}"
 
-if ! grep -q "${ORIGINAL}" "$WORKING_POLICY"; then
-  echo "'${ORIGINAL}' not found in policy configuration, nothing to do."
-  exit 0
-fi
+# The enterprise-contract repository mirrors the release policy: the
+# release process copies the same digest to both tags, so either reference
+# can be pinned to the canonical repository.
+ORIGINALS=(
+  "oci::quay.io/conforma/release-policy:konflux"
+  "oci::quay.io/enterprise-contract/ec-release-policy:konflux"
+)
 
-# If the reference is already digest-pinned (e.g. :konflux@sha256:...),
-# respect the existing pin rather than overriding it.
-if grep -q "${ORIGINAL}@sha256:" "$WORKING_POLICY"; then
-  echo "'${ORIGINAL}' already has a pinned digest, skipping override."
+REPLACED=0
+for ORIGINAL in "${ORIGINALS[@]}"; do
+  if ! grep -q "${ORIGINAL}" "$WORKING_POLICY"; then
+    continue
+  fi
+  # Hide occurrences that are already pinned to a digest behind a marker
+  # so that only floating references are replaced. A global sed alone
+  # cannot distinguish them: ORIGINAL@sha256:<old> contains ORIGINAL.
+  sed -i "s|${ORIGINAL}@sha256:|__PINNED_POLICY_REF__@sha256:|g" "$WORKING_POLICY"
+  if grep -q "${ORIGINAL}" "$WORKING_POLICY"; then
+    sed -i "s|${ORIGINAL}|${REPLACEMENT}|g" "$WORKING_POLICY"
+    echo "Replaced: ${ORIGINAL}"
+    echo "    with: ${REPLACEMENT}"
+    REPLACED=1
+  else
+    echo "'${ORIGINAL}' already has a pinned digest, skipping override."
+  fi
+  # Restore the hidden pinned occurrences.
+  sed -i "s|__PINNED_POLICY_REF__@sha256:|${ORIGINAL}@sha256:|g" "$WORKING_POLICY"
+done
+
+if [ "$REPLACED" -eq 0 ]; then
+  echo "Release policy reference not found in policy configuration, nothing to do."
   exit 0
 fi
 
-sed -i "s|${ORIGINAL}|${REPLACEMENT}|g" "$WORKING_POLICY"
-echo "Replaced: ${ORIGINAL}"
-echo "    with: ${REPLACEMENT}"
-
 POLICY_PATH="${HOME}/policy-with-pinned-bundle.yaml"
 cp "$WORKING_POLICY" "${POLICY_PATH}"
 echo "Modified policy written to: ${POLICY_PATH}"
diff --git a/hack/pin-konflux-policy-bundle_test.sh b/hack/pin-konflux-policy-bundle_test.sh
index 214fadeca..30ee15024 100644
--- a/hack/pin-konflux-policy-bundle_test.sh
+++ b/hack/pin-konflux-policy-bundle_test.sh
@@ -223,6 +223,90 @@ else
 fi
 rm -rf "$TMPDIR"
 
+# -------------------------------------------------------------------
+echo "Test 9: mirror tag reference is replaced"
+# -------------------------------------------------------------------
+TMPDIR="$(mktemp -d)"
+export HOME="${TMPDIR}"
+POLICY_FILE="${TMPDIR}/policy.json"
+cat > "$POLICY_FILE" <<'EOF'
+{"sources":[{"policy":["oci::quay.io/enterprise-contract/ec-release-policy:konflux"]}]}
+EOF
+POLICY_CONFIGURATION="$POLICY_FILE" POLICY_BUNDLE_DIGEST="$NEW_DIGEST" \
+  bash "$SCRIPT" > /dev/null
+
+assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
+  "oci::quay.io/conforma/release-policy@${NEW_DIGEST}" \
+  "mirror reference replaced with pinned canonical reference"
+assert_not_contains "${HOME}/policy-with-pinned-bundle.yaml" \
+  "ec-release-policy" \
+  "mirror reference removed"
+rm -rf "$TMPDIR"
+
+# -------------------------------------------------------------------
+echo "Test 10: already-pinned mirror reference is left alone"
+# -------------------------------------------------------------------
+TMPDIR="$(mktemp -d)"
+export HOME="${TMPDIR}"
+POLICY_FILE="${TMPDIR}/policy.json"
+cat > "$POLICY_FILE" <<EOF
+{"sources":[{"policy":["oci::quay.io/enterprise-contract/ec-release-policy:konflux@${OLD_DIGEST}"]}]}
+EOF
+POLICY_CONFIGURATION="$POLICY_FILE" POLICY_BUNDLE_DIGEST="$NEW_DIGEST" \
+  bash "$SCRIPT" > /dev/null
+
+if [[ ! -f "${HOME}/policy-with-pinned-bundle.yaml" ]]; then
+  echo "  PASS: no output file created (existing mirror pin respected)"
+  (( PASS++ ))
+else
+  echo "  FAIL: should not override an already-pinned mirror reference"
+  (( FAIL++ ))
+fi
+rm -rf "$TMPDIR"
+
+# -------------------------------------------------------------------
+echo "Test 11: pinned canonical plus floating mirror in one config"
+# -------------------------------------------------------------------
+TMPDIR="$(mktemp -d)"
+export HOME="${TMPDIR}"
+POLICY_FILE="${TMPDIR}/policy.json"
+cat > "$POLICY_FILE" <<EOF
+{"sources":[{"policy":["oci::quay.io/conforma/release-policy:konflux@${OLD_DIGEST}","oci::quay.io/enterprise-contract/ec-release-policy:konflux"]}]}
+EOF
+POLICY_CONFIGURATION="$POLICY_FILE" POLICY_BUNDLE_DIGEST="$NEW_DIGEST" \
+  bash "$SCRIPT" > /dev/null
+
+assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
+  "oci::quay.io/conforma/release-policy:konflux@${OLD_DIGEST}" \
+  "existing canonical pin unchanged"
+assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
+  "oci::quay.io/conforma/release-policy@${NEW_DIGEST}" \
+  "floating mirror reference pinned"
+rm -rf "$TMPDIR"
+
+# -------------------------------------------------------------------
+echo "Test 12: pinned and floating mirror references in one config"
+# -------------------------------------------------------------------
+TMPDIR="$(mktemp -d)"
+export HOME="${TMPDIR}"
+POLICY_FILE="${TMPDIR}/policy.json"
+cat > "$POLICY_FILE" <<EOF
+{"sources":[
+  {"policy":["oci::quay.io/enterprise-contract/ec-release-policy:konflux@${OLD_DIGEST}"]},
+  {"policy":["oci::quay.io/enterprise-contract/ec-release-policy:konflux"]}
+]}
+EOF
+POLICY_CONFIGURATION="$POLICY_FILE" POLICY_BUNDLE_DIGEST="$NEW_DIGEST" \
+  bash "$SCRIPT" > /dev/null
+
+assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
+  "oci::quay.io/enterprise-contract/ec-release-policy:konflux@${OLD_DIGEST}" \
+  "existing mirror pin preserved"
+assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
+  "oci::quay.io/conforma/release-policy@${NEW_DIGEST}" \
+  "floating mirror reference pinned"
+rm -rf "$TMPDIR"
+
 # -------------------------------------------------------------------
 echo ""
 echo "Results: ${PASS} passed, ${FAIL} failed"