diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index f49d548..e301834 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -1,5 +1,8 @@
 name: Release Image
 
+# Primary release pipeline — pushes to registry.ginnoir.com (prod pulls this).
+# GitHub Actions .github/workflows/release.yml mirrors to GHCR as backup only.
+
 on:
   push:
     tags:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3a39ed0..8ea82f9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,7 @@
-name: Release
+name: Release (GHCR mirror)
+
+# Temporary backup mirror only. Production pulls from registry.ginnoir.com via
+# .gitea/workflows/release.yml — do not deploy from ghcr.io directly.
 
 on:
   push:
diff --git a/README.md b/README.md
index e946f5e..7e20c06 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ Self-hosted family coordination web app. Shared calendar, lists, notes, and gard
 
 [![CI](https://github.com/ginnoir/famapp/actions/workflows/ci.yml/badge.svg)](https://github.com/ginnoir/famapp/actions/workflows/ci.yml)
 [![Latest release](https://img.shields.io/github/v/release/ginnoir/famapp?sort=semver)](https://github.com/ginnoir/famapp/releases)
-[![Docker image](https://img.shields.io/badge/image-ghcr.io%2Fginnoir%2Ffamapp-blue?logo=docker)](https://github.com/ginnoir/famapp/pkgs/container/famapp)
+[![Docker image](https://img.shields.io/badge/image-registry.ginnoir.com%2Fginnoir%2Ffamapp-blue?logo=docker)](https://gitea.ginnoir.com/ginnoir/famapp)
 [![Node ≥ 22](https://img.shields.io/badge/node-%E2%89%A522-brightgreen?logo=node.js)](https://nodejs.org)
 
 ---
diff --git a/docs/RUNBOOK.md b/docs/RUNBOOK.md
index b6ec747..9ae0da4 100644
--- a/docs/RUNBOOK.md
+++ b/docs/RUNBOOK.md
@@ -15,12 +15,16 @@ pnpm release:patch   # or :minor / :major
 # Requires GITHUB_TOKEN in .env
 ```
 
-Gitea Actions (`release.yml`) then builds and pushes the Docker image to the self-hosted registry:
+Gitea Actions (`.gitea/workflows/release.yml`) builds and pushes the Docker image to the **self-hosted registry** (production source of truth):
 
 - `registry.ginnoir.com/ginnoir/famapp:v0.x.y`
 - `registry.ginnoir.com/ginnoir/famapp:0.x` (minor alias)
 - `registry.ginnoir.com/ginnoir/famapp:latest`
 
+GitHub Actions (`.github/workflows/release.yml`) mirrors the same tag to **GHCR** as a temporary backup only — prod must not pull from `ghcr.io`.
+
+Wait for the Gitea Actions run to finish (or confirm the new digest on the registry) before redeploying.
+
 ## Deploying a release
 
 On the home server, in `/srv/famapp/deploy/`: