diff --git a/README.md b/README.md
index 9cade9f..1e92d6f 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ actions, not reusable workflows: Forgejo LTS 11 does not support
 - `lint-checks` — prettier + eslint + conventional-commit checks (each
   `--if-present`/config-gated); run after `node-checks` in the same job
 - `build-push` — docker build + push to the Forgejo registry
-  (`192.168.1.230:3000`), tags `<short-sha>` + `latest`
+  (`git.lab.holtlabs.xyz`), tags `<short-sha>` + `latest`
 - `gitops-bump` — set the image tag in `nholtware/gitops` via
   `kustomize edit set image`; ArgoCD deploys from there
 
diff --git a/build-push/action.yaml b/build-push/action.yaml
index 4200c79..e29213a 100644
--- a/build-push/action.yaml
+++ b/build-push/action.yaml
@@ -2,8 +2,8 @@ name: build-push
 description: >
   Language-agnostic image build + push to the homelab Forgejo registry.
   The app's Dockerfile owns the toolchain. Run after actions/checkout, on
-  the `host` runner label (host docker daemon has the insecure-registry
-  config -- see homelab nixos/hosts/forgejo/default.nix). Tags pushed:
+  the `host` runner label (the registry is served over HTTPS with a real
+  Let's Encrypt cert, so no insecure-registry config is needed). Tags pushed:
   <short-sha> and latest.
 inputs:
   app-name:
@@ -18,9 +18,9 @@ inputs:
     required: false
     default: Dockerfile
   registry:
-    description: Registry host:port
+    description: Registry host (HTTPS, real cert; add :port only if non-443)
     required: false
-    default: "192.168.1.230:3000"
+    default: "git.lab.holtlabs.xyz"
   registry-user:
     description: Registry login user (pass secrets.REGISTRY_USER)
     required: true
diff --git a/gitops-bump/action.yaml b/gitops-bump/action.yaml
index d8296ed..fe26ac8 100644
--- a/gitops-bump/action.yaml
+++ b/gitops-bump/action.yaml
@@ -18,7 +18,7 @@ inputs:
   registry:
     description: Registry host:port (must match build-push)
     required: false
-    default: "192.168.1.230:3000"
+    default: "git.lab.holtlabs.xyz"
 runs:
   using: composite
   steps:
@@ -31,7 +31,7 @@ runs:
         IMAGE="${{ inputs.registry }}/$GITHUB_REPOSITORY_OWNER/${{ inputs.app-name }}"
         DIR="$(mktemp -d)"
         trap 'rm -rf "$DIR"' EXIT
-        git clone --depth 1 "http://ci-bot:${GITOPS_TOKEN}@192.168.1.230:3000/${{ inputs.gitops-repo }}.git" "$DIR"
+        git clone --depth 1 "https://ci-bot:${GITOPS_TOKEN}@git.lab.holtlabs.xyz/${{ inputs.gitops-repo }}.git" "$DIR"
         cd "$DIR/manifests/${{ inputs.app-name }}"
         kustomize edit set image "${{ inputs.app-name }}=$IMAGE:$TAG"
         cd "$DIR"