diff --git a/.env.example b/.env.example
index c31f2a6..9cedb1a 100644
--- a/.env.example
+++ b/.env.example
@@ -1,7 +1,8 @@
 # Copy to .env and fill in. Never commit the real .env.
+# Note: ACME_EMAIL / Traefik itself are configured separately in ~/traefik/.env —
+# Traefik is shared infra, not part of this stack (see docker-compose.yml comment).
 
 # --- domain / TLS ---
-ACME_EMAIL=you@example.com
 MATRIX_SERVER_NAME=matrix.apps.williamturner.eu
 AGENT_HOSTNAME=agent.apps.williamturner.eu
 # Set to true ONLY for the first-boot window while creating the bot account,
@@ -13,7 +14,7 @@ GITEA_URL=https://gitea.apps.williamturner.eu
 GITEA_TOKEN=
 GITEA_WEBHOOK_SECRET=
 # Image the agent runs from — built and pushed by .gitea/workflows/build.yml
-GITEA_REGISTRY_IMAGE=gitea.apps.williamturner.eu/<your-gitea-username>/claude-agent:latest
+GITEA_REGISTRY_IMAGE=gitea.apps.williamturner.eu/<your-gitea-username>/<repo-name>/claude-agent:latest
 
 # --- anthropic ---
 ANTHROPIC_API_KEY=
diff --git a/act-runner-config.yaml b/act-runner-config.yaml
index 0a8cf28..94aff0d 100644
--- a/act-runner-config.yaml
+++ b/act-runner-config.yaml
@@ -1,6 +1,4 @@
-# Mounts the host Docker socket into every job container act_runner creates, so
-# `docker build`/`docker push` work inside workflow steps (Docker-outside-of-Docker).
-# This is a runner-admin-controlled default (not something a workflow author can
-# request itself), which is the safer of the two ways act_runner supports this.
-container:
-  options: "-v /var/run/docker.sock:/var/run/docker.sock"
+# act_runner auto-detects that it has its own /var/run/docker.sock mounted (see
+# docker-compose.yml) and passes it through to job containers itself — no explicit
+# options needed here. This file is kept (even near-empty) so CONFIG_FILE has a
+# stable target if runner-level settings are needed later.
diff --git a/docker-compose.yml b/docker-compose.yml
index e39a255..19c6e60 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,35 +1,11 @@
 services:
-  traefik:
-    # Must be >=3.6 — Docker 29 raised its minimum API version to 1.44, and Traefik's
-    # Docker provider only gained version auto-negotiation in v3.6.
-    image: traefik:v3.6
-    container_name: traefik
-    restart: unless-stopped
-    command:
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=web"
-      - "--entrypoints.web.address=:80"
-      - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
-      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--log.level=INFO"
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "traefik_letsencrypt:/letsencrypt"
-    networks:
-      - web
-
-  # Routes for services that live in OTHER compose files (Gitea, Portainer) are added
-  # as labels on those containers directly, not here — see README "Fronting existing
-  # services" section.
+  # Traefik deliberately does NOT live in this stack — it's shared infra fronting
+  # Gitea/Portainer/Matrix/agent (see ~/traefik/docker-compose.yml, a separate,
+  # independently-managed stack). It used to be a service here, but a GitOps redeploy
+  # tears every service in a stack down before bringing them back up — and claude-agent's
+  # image pull goes through Traefik→Gitea's registry, so a self-hosted Traefik ends up
+  # briefly tearing down the very route its sibling service needs to come back up.
+  # Circular dependency, self-inflicted outage. Don't put Traefik back in this file.
 
   matrix-homeserver:
     image: ghcr.io/continuwuity/continuwuity:latest
@@ -110,7 +86,6 @@ networks:
     external: true
 
 volumes:
-  traefik_letsencrypt:
   matrix_data:
   agent_workspace:
   act_runner_data: