diff --git a/services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml b/services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
index 6979cd326..8e435d918 100644
--- a/services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
+++ b/services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
@@ -1,6 +1,7 @@
 # services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
 # One-off job for gitea/veles-feedback-acl-ensure-2.
-# Purpose: keep Veles testers on the feedback repo without granting source access.
+# Purpose: keep Veles feedback anonymously readable while limiting write access
+# to testers/admins and avoiding source-code repository access.
 apiVersion: batch/v1
 kind: Job
 metadata:
diff --git a/services/gitea/scripts/veles_feedback_acl_ensure.sh b/services/gitea/scripts/veles_feedback_acl_ensure.sh
index dcb35b87f..8c8d57d0d 100644
--- a/services/gitea/scripts/veles_feedback_acl_ensure.sh
+++ b/services/gitea/scripts/veles_feedback_acl_ensure.sh
@@ -49,11 +49,41 @@ end $$;
 
 update gitea.team team
 set authorize = 1,
-    includes_all_repositories = true,
+    includes_all_repositories = false,
     can_create_org_repo = false
 from veles_acl_ids ids
 where team.id = ids.team_id;
 
+update gitea."user" org
+set visibility = 0
+from veles_acl_ids ids
+where org.id = ids.org_id;
+
+update gitea.repository repo
+set is_private = false
+from veles_acl_ids ids
+where repo.id = ids.repo_id;
+
+delete from gitea.repo_unit unit
+using veles_acl_ids ids
+where unit.repo_id = ids.repo_id
+  and unit.type in (1, 3, 4, 5, 6, 7, 8, 9, 10);
+
+insert into gitea.repo_unit (repo_id, type, config, created_unix, everyone_access_mode)
+select
+  ids.repo_id,
+  2,
+  '{"EnableTimetracker":false,"AllowOnlyContributorsToTrackTime":true,"EnableDependencies":true}',
+  extract(epoch from now())::bigint,
+  0
+from veles_acl_ids ids
+where not exists (
+  select 1
+  from gitea.repo_unit existing
+  where existing.repo_id = ids.repo_id
+    and existing.type = 2
+);
+
 insert into gitea.team_repo (org_id, team_id, repo_id)
 select ids.org_id, ids.team_id, ids.repo_id
 from veles_acl_ids ids
@@ -67,7 +97,7 @@ where not exists (
 delete from gitea.team_unit unit
 using veles_acl_ids ids
 where unit.team_id = ids.team_id
-  and unit.type in (1, 2, 3, 4, 5, 8, 9, 10);
+  and unit.type in (1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
 
 insert into gitea.team_unit (org_id, team_id, type, access_mode)
 select ids.org_id, ids.team_id, desired.type, desired.access_mode
@@ -79,6 +109,8 @@ cross join (
     (3, 0),
     (4, 0),
     (5, 0),
+    (6, 0),
+    (7, 0),
     (8, 0),
     (9, 0),
     (10, 0)