diff --git a/contracts/scripts/README.md b/contracts/scripts/README.md
index e2f2fe446..eb9be1977 100644
--- a/contracts/scripts/README.md
+++ b/contracts/scripts/README.md
@@ -5,6 +5,7 @@ The scripts should run as below sequence:
 ```bash
 export layer1=l1geth # change to actual network name
 export layer2=l2geth # change to actual network name
+export owner=0x0000000000000000000000000000000000000000 # change to actual owner
 
 # deploy contracts in layer 1
 npx hardhat --network $layer1 run scripts/deploy_proxy_admin.ts
@@ -42,6 +43,22 @@ npx hardhat --network $layer2 run scripts/initialize_l2_custom_erc20_gateway.ts
 npx hardhat --network $layer2 run scripts/initialize_l2_erc1155_gateway.ts
 npx hardhat --network $layer2 run scripts/initialize_l2_erc721_gateway.ts
 npx hardhat --network $layer2 run scripts/initialize_l2_token_factory.ts
+
+# transfer ownership in layer 1
+env CONTRACT_NAME=ProxyAdmin CONTRACT_OWNER=$owner npx hardhat run --network $layer1 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L1ScrollMessenger CONTRACT_OWNER=$owner npx hardhat run --network $layer1 scripts/transfer_ownership.ts
+env CONTRACT_NAME=ZKRollup CONTRACT_OWNER=$owner npx hardhat run --network $layer1 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L1GatewayRouter CONTRACT_OWNER=$owner npx hardhat run --network $layer1 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L1CustomERC20Gateway CONTRACT_OWNER=$owner npx hardhat run --network $layer1 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L1ERC721Gateway CONTRACT_OWNER=$owner npx hardhat run --network $layer1 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L1ERC1155Gateway CONTRACT_OWNER=$owner npx hardhat run --network $layer1 scripts/transfer_ownership.ts
+# transfer ownership in layer 2
+env CONTRACT_NAME=ProxyAdmin CONTRACT_OWNER=$owner npx hardhat run --network $layer2 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L2ScrollMessenger CONTRACT_OWNER=$owner npx hardhat run --network $layer2 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L2GatewayRouter CONTRACT_OWNER=$owner npx hardhat run --network $layer2 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L2CustomERC20Gateway CONTRACT_OWNER=$owner npx hardhat run --network $layer2 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L2ERC721Gateway CONTRACT_OWNER=$owner npx hardhat run --network $layer2 scripts/transfer_ownership.ts
+env CONTRACT_NAME=L2ERC1155Gateway CONTRACT_OWNER=$owner npx hardhat run --network $layer2 scripts/transfer_ownership.ts
 ```
 
 Reference testnet [run.sh](https://github.com/scroll-tech/testnet/blob/main/run.sh) for details.
diff --git a/contracts/scripts/deploy_l2_messenger.ts b/contracts/scripts/deploy_l2_messenger.ts
index 664af50fd..80318a593 100644
--- a/contracts/scripts/deploy_l2_messenger.ts
+++ b/contracts/scripts/deploy_l2_messenger.ts
@@ -8,10 +8,11 @@ async function main() {
 
   const [deployer] = await ethers.getSigners();
 
+  const owner = process.env.CONTRACT_OWNER || deployer.address;
   if (!addressFile.get("L2ScrollMessenger")) {
     console.log(">> Deploy L2ScrollMessenger implementation");
     const L2ScrollMessenger = await ethers.getContractFactory("L2ScrollMessenger", deployer);
-    const impl = await L2ScrollMessenger.deploy(deployer.address);
+    const impl = await L2ScrollMessenger.deploy(owner);
     console.log(`>> waiting for transaction: ${impl.deployTransaction.hash}`);
     await impl.deployed();
     console.log(`✅ L2ScrollMessenger implementation deployed at ${impl.address}`);
diff --git a/contracts/scripts/transfer_ownership.ts b/contracts/scripts/transfer_ownership.ts
new file mode 100644
index 000000000..57e4455db
--- /dev/null
+++ b/contracts/scripts/transfer_ownership.ts
@@ -0,0 +1,36 @@
+/* eslint-disable node/no-missing-import */
+import * as dotenv from "dotenv";
+
+import * as hre from "hardhat";
+import { ethers } from "hardhat";
+import { selectAddressFile } from "./utils";
+
+dotenv.config();
+
+async function main() {
+  const addressFile = selectAddressFile(hre.network.name);
+
+  const [deployer] = await ethers.getSigners();
+
+  if (process.env.CONTRACT_NAME === undefined) {
+    throw new Error("env CONTRACT_NAME undefined");
+  }
+  const contractName = process.env.CONTRACT_NAME!;
+  const contractAddress = addressFile.get(`${contractName}.proxy`) || addressFile.get(`${contractName}`);
+  const Contract = await ethers.getContractAt(contractName, contractAddress, deployer);
+
+  const owner = process.env.CONTRACT_OWNER || deployer.address;
+  if ((await Contract.owner()).toLowerCase() !== owner.toLowerCase()) {
+    const tx = await Contract.transferOwnership(owner);
+    console.log(`${contractName} transfer ownership to ${owner}, hash: ${tx.hash}`);
+    const receipt = await tx.wait();
+    console.log(`✅ Done, gas used: ${receipt.gasUsed}`);
+  }
+}
+
+// We recommend this pattern to be able to use async/await everywhere
+// and properly handle errors.
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});