diff --git a/dockerfiles/Dockerfile.monero-p2pool b/dockerfiles/Dockerfile.monero-p2pool
index 4813156..b22355e 100644
--- a/dockerfiles/Dockerfile.monero-p2pool
+++ b/dockerfiles/Dockerfile.monero-p2pool
@@ -1,28 +1,59 @@
 # syntax=docker/dockerfile:1.6
-FROM debian:bookworm-slim
 
-ARG P2POOL_VERSION=v4.9
+ARG DEBIAN_IMAGE=debian:bookworm-slim
+ARG P2POOL_VERSION=4.9
+
+################################################################################
+# Stage: fetch — download & extract the right release asset, normalize to /opt/bin/p2pool
+################################################################################
+FROM ${DEBIAN_IMAGE} AS fetch
 ARG TARGETARCH
-ARG P2POOL_SHA256=""
+ARG P2POOL_VERSION
 
 RUN set -eux; \
     apt-get update; \
-    apt-get install -y --no-install-recommends ca-certificates curl xz-utils tar; \
+    apt-get install -y --no-install-recommends ca-certificates curl jq xz-utils tar unzip; \
     update-ca-certificates; \
+    rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
     case "${TARGETARCH:-arm64}" in \
-      amd64)  ASUF="linux-x86_64" ;; \
-      arm64)  ASUF="linux-arm64" ;; \
-      arm)    ASUF="linux-arm" ;; \
-      *) echo "Unsupported TARGETARCH=${TARGETARCH}"; exit 1 ;; \
+      amd64)  ARCH_RE='(x86_64|amd64)';; \
+      arm64)  ARCH_RE='(arm64|aarch64|armv8)';; \
+      arm)    ARCH_RE='(arm|armv7|armhf)';; \
+      *) echo "Unsupported TARGETARCH=${TARGETARCH}"; exit 1;; \
     esac; \
-    URL="https://github.com/SChernykh/p2pool/releases/download/${P2POOL_VERSION}/p2pool-${ASUF}.tar.gz"; \
-    echo "Downloading $URL"; \
-    curl -fL "$URL" -o /tmp/p2pool.tgz; \
-    if [ -n "$P2POOL_SHA256" ]; then echo "${P2POOL_SHA256}  /tmp/p2pool.tgz" | sha256sum -c -; fi; \
-    tar -xzf /tmp/p2pool.tgz -C /usr/local/bin --wildcards 'p2pool*'; \
-    chmod 0755 /usr/local/bin/p2pool*; \
-    ln -sf /usr/local/bin/p2pool /usr/local/bin/p2pool; \
-    rm -f /tmp/p2pool.tgz
+    API_URL="https://api.github.com/repos/SChernykh/p2pool/releases/tags/v${P2POOL_VERSION}"; \
+    ASSET_URL="$(curl -fsSL -H 'Accept: application/vnd.github+json' "$API_URL" \
+      | jq -r --arg re "$ARCH_RE" \
+        '.assets[] | select((.name|test("linux")) and (.name|test($re))) | .browser_download_url' \
+      | head -n1)"; \
+    test -n "$ASSET_URL"; \
+    echo "Fetching $ASSET_URL"; \
+    curl -fL "$ASSET_URL" -o /tmp/p2pool.pkg; \
+    mkdir -p /tmp/ex && cd /tmp/ex; \
+    case "$ASSET_URL" in \
+      *.tar.xz) tar -xJf /tmp/p2pool.pkg ;; \
+      *.tar.gz) tar -xzf /tmp/p2pool.pkg ;; \
+      *.zip)    unzip -q /tmp/p2pool.pkg ;; \
+      *) echo "Unknown archive format: $ASSET_URL"; exit 1 ;; \
+    esac; \
+    BIN="$(find . -maxdepth 2 -type f -name 'p2pool*' -executable | sort | head -n1)"; \
+    test -n "$BIN"; \
+    install -Dm0755 "$BIN" /opt/bin/p2pool; \
+    /opt/bin/p2pool --help >/dev/null 2>&1 || true
+
+################################################################################
+# Stage: runtime
+################################################################################
+FROM ${DEBIAN_IMAGE}
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates; \
+    update-ca-certificates; \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --from=fetch /opt/bin/p2pool /usr/local/bin/p2pool
 
 EXPOSE 3333
-CMD ["p2pool","--version"]
+ENTRYPOINT ["p2pool"]
diff --git a/scripts/monero_wallet_setup.fish b/scripts/monero_wallet_setup.fish
index 2d6c656..9dffa1c 100644
--- a/scripts/monero_wallet_setup.fish
+++ b/scripts/monero_wallet_setup.fish
@@ -353,6 +353,10 @@ function walletsvc_bootstrap --description "Interactive setup of monero-wallet-r
     set daemon_addr monerod.crypto.svc.cluster.local:18081
   end
   echo "Daemon address (for the Deployment): $daemon_addr"
+  read -P "Override daemon address for this deployment? (host:port, blank to keep): " daemon_override
+  if test -n "$daemon_override"
+    set daemon_addr $daemon_override
+  end
 
   if test -z "$WALLETSVC_SKIP_DAEMON_CHECK"
     _banner "Probing daemon via temporary port-forward"
@@ -367,9 +371,9 @@ function walletsvc_bootstrap --description "Interactive setup of monero-wallet-r
     echo "Skipping daemon probe due to WALLETSVC_SKIP_DAEMON_CHECK=1"
   end
 
-  # Public image that includes monero-wallet-rpc
-  read -P "Container image for wallet RPC [docker.io/sethsimmons/simple-monero-wallet-rpc:latest]: " image
-  if test -z "$image"; set image docker.io/sethsimmons/simple-monero-wallet-rpc:latest; end
+  # Use your private image by default (in Zot)
+  read -P "Container image for wallet RPC [registry.bstein.dev/infra/monero-wallet-rpc:0.18.4.1]: " image
+  if test -z "$image"; set image registry.bstein.dev/infra/monero-wallet-rpc:0.18.4.1; end
   _require "Container image" $image; or return 1
 
   # --- Secrets (defaults: RPC user=wallet name, passwords auto if missing)
diff --git a/services/crypto/xmr-miner/deployment.yaml b/services/crypto/xmr-miner/deployment.yaml
index f3f081e..6098fe4 100644
--- a/services/crypto/xmr-miner/deployment.yaml
+++ b/services/crypto/xmr-miner/deployment.yaml
@@ -2,22 +2,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: p2pool
+  name: monero-p2pool
   namespace: crypto
-  labels: { app: p2pool }
+  labels: { app: monero-p2pool }
 spec:
   replicas: 1
   selector:
-    matchLabels: { app: p2pool }
+    matchLabels: { app: monero-p2pool }
   template:
     metadata:
-      labels: { app: p2pool }
+      labels: { app: monero-p2pool }
     spec:
       nodeSelector:
         node-role.kubernetes.io/worker: "true"
       containers:
-        - name: p2pool
-          image: ghcr.io/sethforprivacy/p2pool:latest
+        - name: monero-p2pool
+          image: registry.bstein.dev/infra/monero-p2pool:4.9
           command: ["p2pool"]
           args:
             - "--host"
diff --git a/services/crypto/xmr-miner/kustomization.yaml b/services/crypto/xmr-miner/kustomization.yaml
index 7cb8594..263b25a 100644
--- a/services/crypto/xmr-miner/kustomization.yaml
+++ b/services/crypto/xmr-miner/kustomization.yaml
@@ -2,7 +2,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - secret-wallet.yaml
   - configmap-sources.yaml
   - deployment.yaml
   - service.yaml
diff --git a/services/crypto/xmr-miner/xmrig-daemonset.yaml b/services/crypto/xmr-miner/xmrig-daemonset.yaml
index 1e24e0c..7c3d324 100644
--- a/services/crypto/xmr-miner/xmrig-daemonset.yaml
+++ b/services/crypto/xmr-miner/xmrig-daemonset.yaml
@@ -1,16 +1,16 @@
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: xmr-xmrig
+  name: monero-xmrig
   namespace: crypto
-  labels: { app: xmr-xmrig }
+  labels: { app: monero-xmrig }
 spec:
   selector:
-    matchLabels: { app: xmr-xmrig }
+    matchLabels: { app: monero-xmrig }
   updateStrategy: { type: RollingUpdate }
   template:
     metadata:
-      labels: { app: xmr-xmrig }
+      labels: { app: monero-xmrig }
     spec:
       priorityClassName: scavenger
       nodeSelector:
@@ -18,7 +18,7 @@ spec:
       volumes:
         - name: payout
           secret:
-            secretName: xmr-payout
+            secretName: monero-payout
       containers:
         - name: xmrig
           image: ghcr.io/tari-project/xmrig:latest