diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 561b71b..0eae41f 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -1,14 +1,16 @@
 # Build all OSINT images, publish to the Forgejo container registry, then
 # redeploy on the Pi runner (docker.sock mounted).
 #
-# Registry: forgejo.siriusdevops.com (NOT ghcr.io)
-# Images:
+# Public pull host: forgejo.siriusdevops.com (NOT ghcr.io)
+# CI push host: 127.0.0.1:3000 — Cloudflare 413s layers ≳100MB on the public
+# hostname, even from the Pi (hairpins out through the tunnel).
+# Images (public names):
 #   forgejo.siriusdevops.com/sirius/osint-dashboard
 #   forgejo.siriusdevops.com/sirius/osint-dashboard-pg
 #   forgejo.siriusdevops.com/sirius/osint-news-scraper
 #   forgejo.siriusdevops.com/sirius/osint-news-summarizer
 #
-# Optional repo variable FORGEJO_REGISTRY overrides the host (default below).
+# Optional repo variable FORGEJO_REGISTRY overrides the *public* pull host.
 # Deploy still uses the local docker socket on the runner host (rpi).
 
 name: build-and-deploy
@@ -19,8 +21,8 @@ on:
   workflow_dispatch:
 
 env:
-  # Hostname only — Forgejo packages registry
-  REGISTRY: ${{ vars.FORGEJO_REGISTRY || 'forgejo.siriusdevops.com' }}
+  PUBLIC_REGISTRY: ${{ vars.FORGEJO_REGISTRY || 'forgejo.siriusdevops.com' }}
+  PUSH_REGISTRY: 127.0.0.1:3000
   OWNER: sirius
   # Keep compose project/volumes stable on the Pi
   COMPOSE_PROJECT_NAME: osint-dashboard
@@ -39,18 +41,21 @@ jobs:
         id: img
         run: |
           set -euo pipefail
-          REG="${REGISTRY}"
+          PUSH="${PUSH_REGISTRY}"
+          PUB="${PUBLIC_REGISTRY}"
           OWN="${OWNER}"
           SHA="${GITHUB_SHA::12}"
           {
-            echo "reg=$REG"
+            echo "reg=$PUSH"
+            echo "pub=$PUB"
             echo "sha=$SHA"
-            echo "app=$REG/$OWN/osint-dashboard"
-            echo "pg=$REG/$OWN/osint-dashboard-pg"
-            echo "scraper=$REG/$OWN/osint-news-scraper"
-            echo "summarizer=$REG/$OWN/osint-news-summarizer"
+            echo "app=$PUSH/$OWN/osint-dashboard"
+            echo "pg=$PUSH/$OWN/osint-dashboard-pg"
+            echo "scraper=$PUSH/$OWN/osint-news-scraper"
+            echo "summarizer=$PUSH/$OWN/osint-news-summarizer"
           } >> "$GITHUB_OUTPUT"
-          echo "Registry: $REG"
+          echo "Push registry: $PUSH"
+          echo "Public pull: $PUB"
           echo "SHA tag: $SHA"
 
       - name: Login to Forgejo registry
@@ -125,10 +130,12 @@ jobs:
           # Compose file still uses localhost/* for stable local names; we mirror
           # registry tags so a cold host can recover via docker pull.
           REG="${{ steps.img.outputs.reg }}"
+          PUB="${{ steps.img.outputs.pub }}"
           OWN="${{ env.OWNER }}"
           for name in osint-dashboard osint-dashboard-pg osint-news-scraper osint-news-summarizer; do
             docker pull "${REG}/${OWN}/${name}:latest" || true
             docker tag "${REG}/${OWN}/${name}:latest" "localhost/${name}:latest" || true
+            docker tag "${REG}/${OWN}/${name}:latest" "${PUB}/${OWN}/${name}:latest" || true
           done
           # Do NOT set COMPOSE_PROJECT_NAME differently — volumes must stay
           # osint-dashboard_osint-pgdata (pinned by `name:` in compose).
@@ -136,15 +143,16 @@ jobs:
             docker compose build app ingester camera-service news-scraper news-summarizer
           docker compose up -d --force-recreate
           docker image prune -f
-          echo "osint-dashboard deployed; images also on ${REG}/${OWN}/"
+          echo "osint-dashboard deployed; images also on ${PUB}/${OWN}/"
 
       - name: Summary
         if: always()
         run: |
           {
             echo "## Forgejo registry images"
-            echo "- \`${{ steps.img.outputs.app }}:latest\`"
-            echo "- \`${{ steps.img.outputs.pg }}:latest\`"
-            echo "- \`${{ steps.img.outputs.scraper }}:latest\`"
-            echo "- \`${{ steps.img.outputs.summarizer }}:latest\`"
+            echo "Pushed via ${{ steps.img.outputs.reg }} (loopback). Pull publicly:"
+            echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-dashboard:latest\`"
+            echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-dashboard-pg:latest\`"
+            echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-news-scraper:latest\`"
+            echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-news-summarizer:latest\`"
           } >> "$GITHUB_STEP_SUMMARY"