diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index b7a1e1a203..8ac660c960 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -31,6 +31,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Update GCP Compute Engine service metadata to new format [(#9641)](https://github.com/prowler-cloud/prowler/pull/9641)
 - Update GCP Dataproc service metadata to new format [(#9642)](https://github.com/prowler-cloud/prowler/pull/9642)
 - Update GCP DNS service metadata to new format [(#9643)](https://github.com/prowler-cloud/prowler/pull/9643)
+- Update GCP GCR service metadata to new format [(#9644)](https://github.com/prowler-cloud/prowler/pull/9644)
 
 ### 🔐 Security
 
diff --git a/prowler/providers/gcp/services/gcr/gcr_container_scanning_enabled/gcr_container_scanning_enabled.metadata.json b/prowler/providers/gcp/services/gcr/gcr_container_scanning_enabled/gcr_container_scanning_enabled.metadata.json
index 52a71e20bc..4d05047a1c 100644
--- a/prowler/providers/gcp/services/gcr/gcr_container_scanning_enabled/gcr_container_scanning_enabled.metadata.json
+++ b/prowler/providers/gcp/services/gcr/gcr_container_scanning_enabled/gcr_container_scanning_enabled.metadata.json
@@ -1,33 +1,38 @@
 {
   "Provider": "gcp",
   "CheckID": "gcr_container_scanning_enabled",
-  "CheckTitle": "Ensure Image Vulnerability Scanning using GCR Container Scanning or a third-party provider",
-  "CheckType": [
-    "Security",
-    "Configuration"
-  ],
+  "CheckTitle": "Project has GCR Container Scanning API enabled",
+  "CheckType": [],
   "ServiceName": "gcr",
-  "SubServiceName": "Container Scanning",
+  "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "Service",
-  "ResourceGroup": "container",
-  "Description": "Scan images stored in Google Container Registry (GCR) for vulnerabilities using GCR Container Scanning or a third-party provider. This helps identify and mitigate security risks associated with known vulnerabilities in container images.",
-  "Risk": "Without image vulnerability scanning, container images stored in GCR may contain known vulnerabilities, increasing the risk of exploitation by malicious actors.",
-  "RelatedUrl": "https://cloud.google.com/container-registry/docs/container-analysis",
+  "ResourceType": "serviceusage.googleapis.com/Service",
+  "Description": "**Google Cloud projects** with `containerscanning.googleapis.com` enabled perform **automatic vulnerability scanning** for images in Container Registry and Artifact Registry.\n\nThe finding indicates whether that service is active to generate and refresh vulnerability metadata for your container images.",
+  "Risk": "Without **image scanning**, vulnerable packages can reach production unchecked, enabling:\n- **Remote code execution** or **privilege escalation** (integrity/availability)\n- **Data exfiltration** from compromised workloads (confidentiality)\n- **Supply chain compromise** via unvetted base images",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/ArtifactRegistry/enable-vulnerability-analysis.html",
+    "https://cloud.google.com/container-registry/docs/container-analysis",
+    "https://docs.cloud.google.com/artifact-analysis/docs/enable-automatic-scanning",
+    "https://cloud.google.com/container-registry/docs/container-best-practices"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "gcloud services enable containerscanning.googleapis.com",
       "NativeIaC": "",
-      "Other": "",
-      "Terraform": "https://docs.prowler.com/checks/gcp/google-cloud-networking-policies/ensure-gcp-gcr-container-vulnerability-scanning-is-enabled#terraform"
+      "Other": "1. In the Google Cloud console, go to APIs & Services > Library\n2. Search for \"Container Scanning API\"\n3. Click the result and then click \"Enable\"",
+      "Terraform": "```hcl\nresource \"google_project_service\" \"<example_resource_name>\" {\n  project = \"<example_project_id>\"\n  service = \"containerscanning.googleapis.com\" # Critical: enables Container Scanning API to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable vulnerability scanning for images stored in GCR using GCR Container Scanning or a third-party provider.",
-      "Url": "https://cloud.google.com/container-registry/docs/container-best-practices"
+      "Text": "Enable `containerscanning.googleapis.com` and integrate results into CI/CD gates. Apply **defense in depth**:\n- Use **Binary Authorization** to block noncompliant images\n- Enforce **least privilege** over who can disable scanning\n- Rebuild and patch frequently; prefer trusted, signed base images",
+      "Url": "https://hub.prowler.com/check/gcr_container_scanning_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "vulnerabilities",
+    "container-security"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": "By default, GCR Container Scanning is disabled."
diff --git a/prowler/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account.metadata.json b/prowler/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account.metadata.json
index 7dafb56df8..d57dc5922c 100644
--- a/prowler/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account.metadata.json
+++ b/prowler/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account.metadata.json
@@ -30,5 +30,8 @@
   "Categories": [],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": "By default, nodes use the Compute Engine default service account when you create a new cluster."
+  "Notes": "By default, nodes use the Compute Engine default service account when you create a new cluster.",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/GKE/ensure-service-account-is-not-the-default-compute-engine-service-account.html"
+  ]
 }