diff --git a/stacks/romhacks/README.md b/stacks/romhacks/README.md
index 8b878be..5a8eff3 100644
--- a/stacks/romhacks/README.md
+++ b/stacks/romhacks/README.md
@@ -37,8 +37,9 @@ Ships idle and safe. It will not export or download until armed:
 2. **Channels**: fill `orchestrator/channels.json` with the per-generation channel
    (or forum) IDs. Add any new file hosts you see to `hosts`.
 3. **Register the stack** in Portainer once (new git stacks need a one-time
-   registration — see memory `portainer-new-stack-registration`). Build is on:
-   Portainer builds `homelab/romhacks-orchestrator` from `./orchestrator`.
+   registration — see memory `portainer-new-stack-registration`). Portainer does
+   **not** build anything: the orchestrator image is built by Gitea Actions and
+   pulled from `registry.ginnoir.com/ginnoir/romhacks-orchestrator:latest`.
 4. **JDownloader FolderWatch**: open the noVNC UI at `http://valhalla:8998`
    (set `VNC_PASSWORD` first), Settings → Extensions → **Folder Watch** → enable,
    add watch folder `/watch`. This is what consumes the orchestrator's crawljobs.
@@ -63,8 +64,18 @@ Ships idle and safe. It will not export or download until armed:
 
 `channels.json` and the scripts are **baked into the image** (Portainer's git-stack
 checkout doesn't reliably bind sibling repo files — see the compose header). So a
-change there needs a **push + rebuild**; if a content-only edit doesn't trigger a
-rebuild, use Portainer → the stack → **Re-pull and redeploy**.
+change under `orchestrator/` needs a **push**, which fires
+`.gitea/workflows/build-romhacks-orchestrator.yml`: it builds the image and pushes
+`registry.ginnoir.com/ginnoir/romhacks-orchestrator` as `:latest` + `:sha-<short>`.
+Portainer then pulls `:latest` on its next 5-min poll (`pull_policy: always`).
+
+Compose has **no `build:`** on purpose — Portainer's auto-update runs
+`docker compose pull` and never `build`, so a build-only image name deadlocks the
+stack. Don't add one back.
+
+To rebuild without a source change, run the workflow manually (Gitea → the repo →
+Actions → *Build romhacks orchestrator image* → **Run workflow**), then Portainer →
+the stack → **Re-pull and redeploy**.
 
 ## Paths
 
diff --git a/stacks/romhacks/docker-compose.yml b/stacks/romhacks/docker-compose.yml
index b5ae161..65c0d3b 100644
--- a/stacks/romhacks/docker-compose.yml
+++ b/stacks/romhacks/docker-compose.yml
@@ -26,12 +26,19 @@
 # DRY_RUN=true, so even if deployed it idles and never enqueues a download. See
 # README.md for the arming checklist.
 #
-# BUILD (not bind) for the orchestrator: Portainer git-stack checkouts do NOT
+# BAKED IMAGE (not bind) for the orchestrator: Portainer git-stack checkouts do NOT
 # reliably materialize sibling repo files at relative FILE bind paths (Docker then
 # auto-creates a directory — see the `share` stack note). So the orchestrator's
-# scripts + channels.json are baked into a built image from ./orchestrator instead
-# of bind-mounted. Editing channels.json => push => Portainer rebuild (use
-# "Re-pull and redeploy" if a content-only change doesn't trigger a rebuild).
+# scripts + channels.json are baked into an image built from ./orchestrator.
+#
+# That image is built by Gitea Actions and pushed to the self-hosted registry —
+# NOT by a compose `build:` context. Portainer's git auto-update only ever runs
+# `docker compose pull`, never `build`, so a `build:` + local-only `image:` name
+# froze this stack: every poll died on "pull access denied for
+# homelab/romhacks-orchestrator" and the stack never advanced past its last good
+# commit. Same pattern as famapp. See .gitea/workflows/build-romhacks-orchestrator.yml.
+# Editing channels.json or the scripts => push => the workflow rebuilds :latest,
+# and watchtower/the next redeploy picks it up.
 #
 # Tiered binds: working state (exports/state/crawljobs + JD config) -> /config
 # (SSD); bulk output + art -> /storage1/labdata/romhacks (ZFS, root-auto-created).
@@ -40,9 +47,8 @@
 
 services:
   romhacks:
-    build:
-      context: ./orchestrator
-    image: homelab/romhacks-orchestrator:latest
+    image: registry.ginnoir.com/ginnoir/romhacks-orchestrator:latest
+    pull_policy: always
     container_name: romhacks
     restart: unless-stopped
     networks: [romhacks]