diff --git a/AGENTS.md b/AGENTS.md
index 97cd7d2..182caf4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -65,9 +65,8 @@ Dockerized Prosody **13.0.6** XMPP server for VNCtalk, built against **Lua 5.4**
 
 ## CI / deploy
 
-- GitLab CI (`.gitlab-ci.yml`). `main` builds + pushes to `eu.gcr.io/vnc-development/vnctalk-prosody:development-$CI_COMMIT_SHORT_SHA`, then Trivy-scans the saved image.
-- Tags `prod-*` retag the matching `development-<version>` to `eu.gcr.io/vnc-dev-275609/vnctalk-prosody:production-<version>`. Tags `stable-*` retag to `eu.gcr.io/vnc-stable/vnctalk-prosody:stable-<version>`. **No rebuild on promotion** — the `<version>` suffix must match an existing dev tag.
-- Kubernetes deploy is via the Helm chart in `helm/prosody/`, synced by ArgoCD (`argo/prosody.yaml`). The Argo manifest sets the live image tag (`release-13.0.6-vnc`) and TLS-update sidecar (`tlsUpdates`).
+- Gitea Actions (`.gitea/workflows/deploy.yml`). `main` builds with kaniko (daemon-less) and pushes to the Gitea registry as `gitea.saas.vnc.biz/vnciac/vnctalk-prosody:sha-<short-sha>` and `:latest`. Auth via `REGISTRY_USER` / `REGISTRY_TOKEN` actions secrets.
+- Kubernetes deploy is via the ArgoCD application in the `vnc-iac-env` GitOps repo (`dev/charts/vnctalk-prosody`). The in-repo `helm/prosody/` + `argo/prosody.yaml` are legacy references, not the live deploy path.
 
 ## Module conventions
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 28bfb3f..3237017 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -47,16 +47,13 @@ There is no application source beyond Lua modules and shell/config templates —
 - No linter or automated test command exists for this repo; verification is "does the image build and does
   Prosody start against the rendered config" (see `test.sh` and `config/startup.sh`).
 
-## CI/CD (`.gitlab-ci.yml`)
+## CI/CD (`.gitea/workflows/deploy.yml`)
 
-- `main` branch pushes: build + push image to `eu.gcr.io/vnc-development/vnctalk-prosody:development-$CI_COMMIT_SHORT_SHA`,
-  then Trivy-scan the saved image.
-- Tags matching `prod-*`: retag the matching `development-<version>` image to
-  `eu.gcr.io/vnc-dev-275609/vnctalk-prosody:production-<version>` and push.
-- Tags matching `stable-*`: retag the matching `development-<version>` image to
-  `eu.gcr.io/vnc-stable/vnctalk-prosody:stable-<version>` and push.
-- Promotion (dev → prod/stable) works by re-tagging an already-built dev image, not rebuilding — the
-  `<version>` suffix must match an existing `development-<version>` tag.
+- `main` branch pushes: build the image with kaniko (daemon-less, fetched via `crane`) and push to the
+  Gitea registry as `gitea.saas.vnc.biz/vnciac/vnctalk-prosody:sha-<short-sha>` and `:latest`.
+- Registry auth comes from the Gitea Actions secrets `REGISTRY_USER` / `REGISTRY_TOKEN`.
+- The image is deployed by the ArgoCD application in the `vnc-iac-env` GitOps repo
+  (`dev/charts/vnctalk-prosody`), not by any manifest in this repo.
 
 ## Working with patches vs. vnctalk modules
 
diff --git a/README.md b/README.md
index 2d86363..d43dff1 100644
--- a/README.md
+++ b/README.md
@@ -32,8 +32,9 @@ argo/prosody.yaml  →  helm/prosody/  →  Docker image (release-13.0.6-vnc)
   chart and overrides values as needed.
 - **Helm chart** (`helm/prosody/`) defines the Deployment, Service, Ingress,
   HPA, PDB, and ServiceAccount templates.
-- **Docker image** is built by GitLab CI from the `Dockerfile`, pushed to
-  `eu.gcr.io`, and referenced by tag in `argo/prosody.yaml`.
+- **Docker image** is built by Gitea Actions (`.gitea/workflows/deploy.yml`) from
+  the `Dockerfile`, pushed to the Gitea registry (`gitea.saas.vnc.biz/vnciac/vnctalk-prosody`),
+  and referenced by tag in the ArgoCD application in the `vnc-iac-env` GitOps repo.
 
 No other deployment method is supported. The `test.sh` / `docker-compose.yml`
 files are for local testing only.
diff --git a/argo/prosody-secrets.example.yaml b/argo/prosody-secrets.example.yaml
index fa608af..f5f9613 100644
--- a/argo/prosody-secrets.example.yaml
+++ b/argo/prosody-secrets.example.yaml
@@ -14,9 +14,9 @@
 #   * Sealed Secrets  — commit a SealedSecret (Bitnami); the controller
 #                       decrypts it in-cluster. Replace the Secret below with a
 #                       SealedSecret produced by `kubeseal`.
-#   * External Secrets Operator — reference an external vault (GCP Secret
-#                       Manager, AWS Secrets Manager, HashiCorp Vault) via a
-#                       SecretStore + ExternalSecret; no secret material in Git.
+#   * External Secrets Operator — reference an external vault (AWS Secrets
+#                       Manager, HashiCorp Vault, or the self-hosted Infisical)
+#                       via a SecretStore + ExternalSecret; no secret material in Git.
 #   * SOPS / age-encrypted manifests decrypted by ArgoCD's KSOPS plugin.
 #
 # The keys below MUST match `secretEnv.keys` in argo/prosody.yaml:
@@ -55,7 +55,7 @@ spec:
   project: default
   source:
     path: charts/prosody-secrets
-    repoURL: git@gitlab.example.com:helmcharts.git
+    repoURL: https://gitea.saas.vnc.biz/VNC/vnctalk-prosody.git
     targetRevision: HEAD
   syncPolicy:
     automated:
diff --git a/argo/prosody.yaml b/argo/prosody.yaml
index 089d8ff..cf31d73 100644
--- a/argo/prosody.yaml
+++ b/argo/prosody.yaml
@@ -13,7 +13,7 @@ spec:
   source:
     # example for a Helm chart from a Git repository
     path: charts/prosody
-    repoURL: git@gitlab.example.com:helmcharts.git
+    repoURL: https://gitea.saas.vnc.biz/VNC/vnctalk-prosody.git
     targetRevision: HEAD
     helm:
       parameters:
@@ -21,7 +21,7 @@ spec:
           value: "prosody"
       values: |
         imagePullSecrets:
-        - name: gcr-json-key
+        - name: gitea-registry
 
         securityContext:
           readOnlyRootFilesystem: true
@@ -29,7 +29,7 @@ spec:
           runAsUser: 1001
 
         image:
-          repository: eu.gcr.io/vnc-development/vnctalk-prosody
+          repository: gitea.saas.vnc.biz/vnciac/vnctalk-prosody
           pullPolicy: IfNotPresent
           # Overrides the image tag whose default is the chart appVersion.
           tag: release-13.0.6-vnc
diff --git a/helm/prosody/templates/service.yaml b/helm/prosody/templates/service.yaml
index 805c42b..595fe5b 100644
--- a/helm/prosody/templates/service.yaml
+++ b/helm/prosody/templates/service.yaml
@@ -27,7 +27,6 @@ metadata:
   {{- if .Values.service.annotationsenabled }}
   {{- with .Values.service.s2s.annotations }}
   annotations:
-    #beta.cloud.google.com/backend-config: '{"ports": {"8000":"prosody"}}'
     {{- toYaml . | nindent 4 }}
   {{- end }}
   {{- end }}
@@ -54,7 +53,6 @@ metadata:
   {{- if .Values.service.annotationsenabled }}
   {{- with .Values.service.annotations }}
   annotations:
-    #beta.cloud.google.com/backend-config: '{"ports": {"8000":"prosody"}}'
     {{- toYaml . | nindent 4 }}
   {{- end }}
   {{- end }}
diff --git a/helm/prosody/values.yaml b/helm/prosody/values.yaml
index d077bca..abdd22c 100644
--- a/helm/prosody/values.yaml
+++ b/helm/prosody/values.yaml
@@ -5,7 +5,7 @@
 replicaCount: 1
 
 image:
-  repository: eu.gcr.io/vnc-development/vnctalk-prosody
+  repository: gitea.saas.vnc.biz/vnciac/vnctalk-prosody
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
   tag: release-13.0.6-vnc