diff --git a/deploy/k8s/base/deployment.yaml b/deploy/k8s/base/deployment.yaml
index f72e952c..b0ad23c0 100644
--- a/deploy/k8s/base/deployment.yaml
+++ b/deploy/k8s/base/deployment.yaml
@@ -23,14 +23,14 @@ spec:
         fsGroup: 1001
         runAsUser: 1001
         runAsGroup: 1001
-      # ghcr package is private by default — see deploy/k8s/README.md to create
-      # this pull secret. Delete this block if you make the package public.
-      # NOTE: once CI moves to pushing registry.gitlab.vnc.biz images (the
-      # dev-auto-deploy phase of the GitLab pipeline), this needs to become a
-      # docker-registry secret for that registry instead — comments only,
-      # deliberately not renamed here, so this file stays a no-op today.
-      imagePullSecrets:
-        - name: ghcr-pull
+      # Confirmed 2026-08-05: ghcr.io/brvncde-dotcom/vncmail-plus-dev IS public
+      # (anonymous token pull succeeded) — no imagePullSecrets needed. This is
+      # deploy/k8s/README.md's own documented alternative to creating a
+      # ghcr-pull secret. Removed rather than left referencing a
+      # not-yet-created secret, which would otherwise block every pod from
+      # starting regardless of the image being public (kubelet fails to
+      # resolve a missing imagePullSecrets entry before it ever gets to
+      # deciding whether auth was actually required).
       containers:
         - name: vncmail-plus
           # Default/legacy value — CI overrides the image per-deploy via