diff --git a/services/gitea/deployment.yaml b/services/gitea/deployment.yaml
index ab0fe963..e16445be 100644
--- a/services/gitea/deployment.yaml
+++ b/services/gitea/deployment.yaml
@@ -90,7 +90,7 @@ spec:
       serviceAccountName: gitea-vault
       initContainers:
         - name: configure-oidc
-          image: gitea/gitea:1.23
+          image: gitea/gitea:1.23@sha256:8b5a98abe52dacbead16eb4179c9abb7c217d523df3a75901343906ae7853357
           securityContext:
             runAsUser: 1000
             runAsGroup: 1000
@@ -200,30 +200,12 @@ spec:
               mountPath: /data
       nodeSelector:
         node-role.kubernetes.io/worker: "true"
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: hardware
-                operator: In
-                values: ["rpi5"]
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                - key: hardware
-                  operator: In
-                  values: ["rpi5"]
-            - weight: 100
-              preference:
-                matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values: ["titan-20","titan-21"]
+        # Last-resort CPU placement while the healthy Pi pool lacks headroom.
+        # Restore Pi preference only after service peaks and one CI agent fit.
+        kubernetes.io/hostname: titan-22
       containers:
         - name: gitea
-          image: gitea/gitea:1.23
+          image: gitea/gitea:1.23@sha256:8b5a98abe52dacbead16eb4179c9abb7c217d523df3a75901343906ae7853357
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -246,6 +228,14 @@ spec:
               name: http
             - containerPort: 2242
               name: ssh
+          readinessProbe:
+            httpGet:
+              path: /api/healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
           env:
             - name: USER_UID
               value: "1000"
@@ -294,7 +284,7 @@ spec:
           resources:
             requests:
               cpu: 500m
-              memory: 1Gi
+              memory: 2Gi
             limits:
               cpu: 1500m
               # Raised from 2Gi: the pod sat at 2073Mi and wedged, refusing