diff --git a/portainer-compose.yml b/portainer-compose.yml
index b4e1977..a415141 100644
--- a/portainer-compose.yml
+++ b/portainer-compose.yml
@@ -71,6 +71,121 @@ services:
     labels:
       - "com.centurylabs.watchtower.enable=false"
 
+  postgres_gitea:
+    container_name: postgres_gitea
+    image: postgres:16-alpine
+    restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+    networks:
+      - gitea_internal
+    environment:
+      POSTGRES_USER: gitea
+      POSTGRES_PASSWORD: ${GITEA_DB_PASSWORD}
+      POSTGRES_DB: gitea
+    volumes:
+      - /config/gitea/postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U gitea -d gitea"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  gitea:
+    container_name: gitea
+    image: gitea/gitea:latest
+    restart: unless-stopped
+    networks:
+      - gitea_internal
+      - edge
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=postgres_gitea:5432
+      - GITEA__database__NAME=gitea
+      - GITEA__database__USER=gitea
+      - GITEA__database__PASSWD=${GITEA_DB_PASSWORD}
+      - GITEA__server__DOMAIN=gitea.ginnoir.com
+      - GITEA__server__ROOT_URL=https://gitea.ginnoir.com
+      - GITEA__server__SSH_DOMAIN=gitea.ginnoir.com
+      - GITEA__server__SSH_PORT=2222
+      - GITEA__repository__ROOT=/repos
+      - GITEA__lfs__PATH=/repos-lfs
+    volumes:
+      - /config/gitea:/data
+      - /storage1/labdata/gitea/repositories:/repos
+      - /storage1/labdata/gitea/lfs:/repos-lfs
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "3030:3000"
+      - "2222:22"
+    depends_on:
+      postgres_gitea:
+        condition: service_healthy
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+
+  gitea-runner:
+    container_name: gitea_runner
+    image: gitea/act_runner:latest
+    restart: unless-stopped
+    networks:
+      - gitea_internal
+    environment:
+      - GITEA_INSTANCE_URL=https://gitea.ginnoir.com
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
+      - GITEA_RUNNER_NAME=valhalla-management-runner
+      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://node:24-bookworm,node-24:docker://node:24-bookworm
+    volumes:
+      - /config/gitea/act_runner:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/ginnoir/valhalla-lab:/valhalla-lab
+      - /config/caddy:/config/caddy
+    depends_on:
+      gitea:
+        condition: service_started
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+
+  registry:
+    container_name: registry
+    image: registry:2
+    restart: unless-stopped
+    networks:
+      - registry_internal
+      - edge
+    environment:
+      - REGISTRY_AUTH=htpasswd
+      - REGISTRY_AUTH_HTPASSWD_REALM=Valhalla Registry
+      - REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd
+      - REGISTRY_STORAGE_DELETE_ENABLED=true
+    volumes:
+      - /storage1/labdata/registry:/var/lib/registry
+      - /config/registry/auth:/auth:ro
+    ports:
+      - "5000:5000"
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+
+  registry-ui:
+    container_name: registry_ui
+    image: joxit/docker-registry-ui:latest
+    restart: unless-stopped
+    networks:
+      - registry_internal
+      - edge
+    environment:
+      - SINGLE_REGISTRY=true
+      - REGISTRY_TITLE=Valhalla Registry
+      - NGINX_PROXY_PASS_URL=http://registry:5000
+      - SHOW_CONTENT_DIGEST=true
+      - DELETE_IMAGES=true
+    depends_on:
+      - registry
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+
   github-runner:
     container_name: github_runner
     image: myoung34/github-runner:latest
@@ -109,3 +224,9 @@ networks:
   portainer_proxy:
     name: portainer_proxy
     driver: bridge
+  gitea_internal:
+    name: gitea_internal
+    driver: bridge
+  registry_internal:
+    name: registry_internal
+    driver: bridge
diff --git a/stacks/dev/docker-compose.yml b/stacks/dev/docker-compose.yml
index 50e4d8f..ecb76aa 100644
--- a/stacks/dev/docker-compose.yml
+++ b/stacks/dev/docker-compose.yml
@@ -1,96 +1,14 @@
-# dev stack — developer tooling: Gitea, code-server, registry, DBX, BookStack, Plane.
-# (Renamed from "dev-stack"; private network renamed devstack -> dev. Vault moved
-# to the management plane. All named volumes converted to tiered bind mounts.)
+# dev stack — developer tooling: code-server, DBX, BookStack, Plane.
+# (Gitea, gitea-runner, postgres_gitea, registry, and registry-ui moved to the
+# management plane in portainer-compose.yml.)
 #
 # Volume -> bind-mount conversions:
-#   gitea  db    -> /config/gitea/postgres         (SSD)
 #   dbx    data  -> /config/dbx                     (SSD)
 #   plane  db    -> /config/plane/postgres          (SSD)
 #   plane  redis -> /config/plane/redis             (SSD)
 #   plane  minio -> /storage1/labdata/plane/minio   (ZFS; attachments)
-# Tier-corrections (already bind-mounted, moved SSD -> ZFS):
-#   registry           -> /storage1/labdata/registry        (image layers)
-#   gitea repositories -> /storage1/labdata/gitea/repositories (git repos)
-#   gitea lfs          -> /storage1/labdata/gitea/lfs          (large files)
-# Gitea config/avatars/indexers stay on SSD (/config/gitea). The repo/LFS split
-# is set via GITEA__repository__ROOT and GITEA__lfs__PATH pointing at ZFS mounts.
 
 services:
-  # ============================================================ GITEA
-  gitea:
-    container_name: gitea
-    image: gitea/gitea:latest
-    restart: unless-stopped
-    networks: [dev, edge]
-    env_file:
-      - stack.env
-    environment:
-      - USER_UID=1000
-      - USER_GID=1000
-      - GITEA__database__DB_TYPE=postgres
-      - GITEA__database__HOST=postgres_gitea:5432
-      - GITEA__database__NAME=gitea
-      - GITEA__database__USER=gitea
-      - GITEA__database__PASSWD=${GITEA_DB_PASSWORD:-gitea_d3vp4ss_9f2k}
-      - GITEA__server__DOMAIN=gitea.ginnoir.com
-      - GITEA__server__ROOT_URL=https://gitea.ginnoir.com
-      - GITEA__server__SSH_DOMAIN=gitea.ginnoir.com
-      - GITEA__server__SSH_PORT=2222
-      # High-density git data on the ZFS pool; config stays on SSD (/data)
-      - GITEA__repository__ROOT=/repos
-      - GITEA__lfs__PATH=/repos-lfs
-    volumes:
-      - /config/gitea:/data
-      - /storage1/labdata/gitea/repositories:/repos
-      - /storage1/labdata/gitea/lfs:/repos-lfs
-      - /etc/localtime:/etc/localtime:ro
-    ports:
-      - "3030:3000"
-      - "2222:22"
-    depends_on:
-      postgres_gitea:
-        condition: service_healthy
-
-  gitea-runner:
-    container_name: gitea_runner
-    image: gitea/act_runner:latest
-    restart: unless-stopped
-    networks: [dev]
-    env_file:
-      - stack.env
-    environment:
-      - GITEA_INSTANCE_URL=https://gitea.ginnoir.com
-      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
-      - GITEA_RUNNER_NAME=valhalla-dev-runner
-      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://node:24-bookworm,node-24:docker://node:24-bookworm
-    volumes:
-      - /config/gitea/act_runner:/data
-      - /var/run/docker.sock:/var/run/docker.sock
-    depends_on:
-      gitea:
-        condition: service_started
-
-  postgres_gitea:
-    container_name: postgres_gitea
-    image: postgres:16-alpine
-    restart: unless-stopped
-    labels:
-      - "com.centurylabs.watchtower.enable=false"
-    networks: [dev]
-    env_file:
-      - stack.env
-    environment:
-      POSTGRES_USER: gitea
-      POSTGRES_PASSWORD: ${GITEA_DB_PASSWORD:-gitea_d3vp4ss_9f2k}
-      POSTGRES_DB: gitea
-    volumes:
-      - /config/gitea/postgres:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U gitea -d gitea"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
   # ============================================================ CODE-SERVER
   code-server:
     container_name: code_server
@@ -112,31 +30,6 @@ services:
     ports:
       - "8443:8443"
 
-  # ============================================================ REGISTRY
-  registry:
-    container_name: registry
-    image: registry:2
-    restart: unless-stopped
-    networks: [dev, edge]
-    volumes:
-      - /storage1/labdata/registry:/var/lib/registry
-    ports:
-      - "5000:5000"
-
-  registry-ui:
-    container_name: registry_ui
-    image: joxit/docker-registry-ui:latest
-    restart: unless-stopped
-    networks: [dev, edge]
-    env_file:
-      - stack.env
-    environment:
-      - SINGLE_REGISTRY=true
-      - REGISTRY_TITLE=Valhalla Registry
-      - NGINX_PROXY_PASS_URL=http://registry:5000
-      - SHOW_CONTENT_DIGEST=true
-      - DELETE_IMAGES=true
-
   # ============================================================ DBX
   dbx:
     container_name: dbx
diff --git a/stacks/dev/stack.env b/stacks/dev/stack.env
index 985eece..0c28fb0 100644
--- a/stacks/dev/stack.env
+++ b/stacks/dev/stack.env
@@ -1,9 +1,6 @@
 # dev stack secrets
 TZ=America/Chicago
 
-# Gitea
-GITEA_DB_PASSWORD=gitea_d3vp4ss_9f2k
-
 # code-server (VS Code in browser)
 CODE_SERVER_PASSWORD=c0de_s3rver_pass