diff --git a/.env b/.env
index 1cb27e2..8670235 100644
--- a/.env
+++ b/.env
@@ -142,3 +142,16 @@ VAULT_UNSEAL_KEY_3=SWXVKnhoYsT6XNiUnWKgTgle2JwsRUNZzX4J3XK++l6n
 VAULT_UNSEAL_KEY_4=rjSgX+lie2ulhJpm+yiWf3mY0hd+8JI6zbPlJPN5Scm+
 VAULT_UNSEAL_KEY_5=UIt78/Qi+rO+krJ4Nt0quTGHQlj+MYaXqt+kt7pAqDma
 VAULT_ROOT_TOKEN=hvs.QmhZvkXnFfebbRC7JVFLcNPn
+
+# =============================================================
+# DOCKER REGISTRY
+# =============================================================
+REGISTRY_PUSH_USERNAME=registry_push
+REGISTRY_PUSH_PASSWORD=uBerCmqKpDn8HKMhELZDbY5a5mJrwxSWTu78Tpp3b7g
+REGISTRY_PULL_USERNAME=registry_pull
+REGISTRY_PULL_PASSWORD=MF38ASyGFpFzr2x4xy5u6EtyFoxAgF4qLUF8wYjGrss
+
+# =============================================================
+# GITEA RUNNER
+# =============================================================
+GITEA_RUNNER_REGISTRATION_TOKEN=
diff --git a/scripts/new-registry-auth.ps1 b/scripts/new-registry-auth.ps1
new file mode 100644
index 0000000..fbb9ae0
--- /dev/null
+++ b/scripts/new-registry-auth.ps1
@@ -0,0 +1,37 @@
+[CmdletBinding()]
+param(
+    [string]$OutputDirectory = (Join-Path $env:TEMP "valhalla-registry-auth"),
+    [string]$PushUser = "registry_push",
+    [string]$PullUser = "registry_pull"
+)
+
+$ErrorActionPreference = "Stop"
+
+function New-Secret {
+    $bytes = New-Object byte[] 32
+    [System.Security.Cryptography.RandomNumberGenerator]::Fill($bytes)
+    return [Convert]::ToBase64String($bytes).TrimEnd("=")
+}
+
+New-Item -ItemType Directory -Force -Path $OutputDirectory | Out-Null
+
+$pushPassword = New-Secret
+$pullPassword = New-Secret
+$htpasswdPath = Join-Path $OutputDirectory "htpasswd"
+$envPath = Join-Path $OutputDirectory "registry.env"
+
+$pushLine = docker run --rm --entrypoint htpasswd httpd:2 -Bbn $PushUser $pushPassword
+$pullLine = docker run --rm --entrypoint htpasswd httpd:2 -Bbn $PullUser $pullPassword
+
+Set-Content -LiteralPath $htpasswdPath -NoNewline -Value ($pushLine + "`n" + $pullLine + "`n")
+Set-Content -LiteralPath $envPath -NoNewline -Value @"
+REGISTRY_PUSH_USERNAME=$PushUser
+REGISTRY_PUSH_PASSWORD=$pushPassword
+REGISTRY_PULL_USERNAME=$PullUser
+REGISTRY_PULL_PASSWORD=$pullPassword
+"@
+
+Write-Host "Created:"
+Write-Host "  $htpasswdPath"
+Write-Host "  $envPath"
+Write-Host "Append registry.env values to .env, then copy htpasswd to valhalla:/config/registry/auth/htpasswd."