diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
index f0fbad6..7a4fa3f 100644
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@@ -10,20 +10,20 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      - uses: http://192.168.1.230:3000/nholtware/workflows/node-checks@main
-      - uses: http://192.168.1.230:3000/nholtware/workflows/lint-checks@main
+      - uses: https://git.holtlabs.xyz/nholtware/workflows/node-checks@v1
+      - uses: https://git.holtlabs.xyz/nholtware/workflows/lint-checks@v1
 
   deploy:
     needs: checks
     runs-on: host
     steps:
       - uses: actions/checkout@v4
-      - uses: http://192.168.1.230:3000/nholtware/workflows/build-push@main
+      - uses: https://git.holtlabs.xyz/nholtware/workflows/build-push@v1
         with:
           app-name: demo-app
           registry-user: ${{ secrets.REGISTRY_USER }}
           registry-token: ${{ secrets.REGISTRY_TOKEN }}
-      - uses: http://192.168.1.230:3000/nholtware/workflows/gitops-bump@main
+      - uses: https://git.holtlabs.xyz/nholtware/workflows/gitops-bump@v1
         with:
           app-name: demo-app
           gitops-token: ${{ secrets.GITOPS_TOKEN }}
diff --git a/.forgejo/workflows/pr.yaml b/.forgejo/workflows/pr.yaml
index 977464d..c1c68e1 100644
--- a/.forgejo/workflows/pr.yaml
+++ b/.forgejo/workflows/pr.yaml
@@ -8,5 +8,5 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      - uses: http://192.168.1.230:3000/nholtware/workflows/node-checks@main
-      - uses: http://192.168.1.230:3000/nholtware/workflows/lint-checks@main
+      - uses: https://git.holtlabs.xyz/nholtware/workflows/node-checks@v1
+      - uses: https://git.holtlabs.xyz/nholtware/workflows/lint-checks@v1
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 67b1207..3c2e903 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -7,12 +7,12 @@ on:
       - synchronize
       - reopened
     branches:
-      - '**'
+      - "**"
   push:
     branches:
-      - '**'
-      - '!main'
-      - '!master'
+      - "**"
+      - "!main"
+      - "!master"
 
 jobs:
   test:
diff --git a/.gitignore b/.gitignore
index b947077..1e77522 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 node_modules/
 dist/
+session-*.md
diff --git a/Dockerfile b/Dockerfile
index 8b5bf16..0938555 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,14 +7,15 @@ COPY tsconfig.json ./
 COPY src ./src
 RUN npm run build
 
-# Runtime stage: no dev deps (this service has zero runtime deps)
+# Runtime stage: production deps only
 FROM node:22-slim
 WORKDIR /app
 ENV NODE_ENV=production
 ARG GIT_SHA=dev
 ENV GIT_SHA=${GIT_SHA}
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
 COPY --from=build /app/dist ./dist
-COPY package.json ./
 USER node
 EXPOSE 3000
-CMD ["node", "dist/index.js"]
+CMD ["node", "dist/bin/server.js"]
diff --git a/README.md b/README.md
index 3473cf5..e25f2db 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ Minimal TypeScript microservice proving out the homelab CI/CD pipeline:
 push to main
   -> Forgejo Actions (nholtware/workflows composite actions)
        checks:  npm ci + lint + test          (docker label)
-       build:   docker build + push           -> 192.168.1.230:3000/nholtware/demo-app:<sha>
+       build:   docker build + push           -> git.holtlabs.xyz/nholtware/demo-app:<sha>
        deploy:  kustomize edit set image      -> commit to nholtware/gitops
   -> ArgoCD syncs gitops -> k3s
   -> served by Traefik at Host: demo-app.k3s.local