diff --git a/.forgejo/workflows/production.yaml b/.forgejo/workflows/production.yaml
index 981370b6..1875b48a 100644
--- a/.forgejo/workflows/production.yaml
+++ b/.forgejo/workflows/production.yaml
@@ -5,9 +5,13 @@ on:
     branches:
       - main
 
+# Image hosted on Codeberg's container registry. The shared
+# REGISTRY_USER / REGISTRY_PASSWORD secrets carry Codeberg credentials;
+# login URL is the hardcoded env.REGISTRY rather than secrets.REGISTRY_URL
+# so a stale URL secret can't push to the wrong registry.
 env:
-  REGISTRY: git.mcintire.me
-  IMAGE_NAME: graham/towerops-web
+  REGISTRY: codeberg.org
+  IMAGE_NAME: gmcintire/towerops
 
 jobs:
   test-exunit:
@@ -127,7 +131,7 @@ jobs:
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login \
             --username "${{ secrets.REGISTRY_USER }}" \
             --password-stdin \
-            "${{ secrets.REGISTRY_URL }}"
+            "${{ env.REGISTRY }}"
 
           docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
           docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index d5aa8657..b8eede47 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: migrate
-          image: git.mcintire.me/graham/towerops-web:main-1777403311-23304e1
+          image: codeberg.org/gmcintire/towerops:main-1777403311-23304e1
           imagePullPolicy: IfNotPresent
           command: ["/app/bin/migrate"]
           securityContext:
@@ -100,7 +100,7 @@ spec:
               cpu: "500m"
       containers:
         - name: towerops
-          image: git.mcintire.me/graham/towerops-web:main-1777403311-23304e1
+          image: codeberg.org/gmcintire/towerops:main-1777403311-23304e1
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false