diff --git a/.forgejo/workflows/dimensionlab-website.yml b/.forgejo/workflows/dimensionlab-website.yml
index 672ab25..198a8aa 100644
--- a/.forgejo/workflows/dimensionlab-website.yml
+++ b/.forgejo/workflows/dimensionlab-website.yml
@@ -48,17 +48,20 @@ jobs:
   deploy:
     needs: ci
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: docker
-    container:
-      image: ghcr.io/catthehacker/ubuntu:act-latest
-      options: --security-opt label=disable
+    runs-on: deploy
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: https://data.forgejo.org/actions/checkout@v4
-        with:
-          fetch-depth: 0
-          submodules: false
+        run: |
+          if [ -d .git ]; then
+            git remote set-url origin git@git.dimensionlab.net:vince/dimensionlab-website.git
+          else
+            git init
+            git remote add origin git@git.dimensionlab.net:vince/dimensionlab-website.git
+          fi
+          git fetch --force --prune --depth=1 origin "$GITHUB_SHA"
+          git checkout --force --detach "$GITHUB_SHA"
+          git clean -ffdx
 
       - name: Initialize submodules
         run: |
@@ -67,13 +70,14 @@ jobs:
 
       - name: Verify Podman deployment socket
         run: |
-          timeout 15s docker version
-          unit="$(timeout 15s docker inspect dimensionlab-website --format '{{ index .Config.Labels "PODMAN_SYSTEMD_UNIT" }}')"
+          command -v podman
+          command -v systemctl
+          unit="$(timeout 15s podman inspect dimensionlab-website --format '{{ index .Config.Labels "PODMAN_SYSTEMD_UNIT" }}')"
           test "$unit" = "dimensionlab-website.service"
 
       - name: Deploy production website
         env:
-          DEPLOY_CONTAINER_CLI: docker
+          DEPLOY_CONTAINER_CLI: podman
           DEPLOY_EVENT_NAME: ${{ github.event_name }}
           DEPLOY_REF: ${{ github.ref }}
           DEPLOY_RESTART_STRATEGY: quadlet-container
diff --git a/README.md b/README.md
index 00d9708..85177c5 100644
--- a/README.md
+++ b/README.md
@@ -161,3 +161,27 @@ The env file must provide `AGENT_CONFIG_TOKEN`. Runtime defaults inside the
 image set `HOST=0.0.0.0`, `PORT=3000`,
 `DATABASE_URL=file:/data/dimensionlab.sqlite`, and
 `DASHBOARD_MIGRATIONS_DIR=/repo/apps/web/drizzle`.
+
+### Forgejo Actions Deployment
+
+Merges to `main` run `.forgejo/workflows/dimensionlab-website.yml`. Pull
+requests run check, test, and build only; the deploy job is guarded to run only
+for `push` events on `refs/heads/main`.
+
+The workflow uses two runner classes. Pull request CI runs on the containerized
+`docker` runner. Production deployment runs on a separate host runner with the
+`deploy:host` label so the guarded deploy script can use the user's rootless
+`podman` and `systemctl --user` commands directly. The deploy job uses a
+shell-only `git fetch` checkout so the host runner does not need a Node runtime
+for checkout actions.
+
+```yaml
+runner:
+  labels:
+    - deploy:host
+```
+
+The deploy job also performs a host preflight against the
+`dimensionlab-website.service` Podman label before it builds or restarts the
+production container. Do not give the general pull request runner deployment
+socket access; keep deploy privileges on the dedicated `deploy` runner.
diff --git a/apps/web/src/lib/dashboard-seed/dimensionlab.test.ts b/apps/web/src/lib/dashboard-seed/dimensionlab.test.ts
index 31c01d9..1a97c3b 100644
--- a/apps/web/src/lib/dashboard-seed/dimensionlab.test.ts
+++ b/apps/web/src/lib/dashboard-seed/dimensionlab.test.ts
@@ -128,7 +128,6 @@ const verifiedSeedIconIds = new Set([
   "mdi:pulse",
   "mdi:robot-outline",
   "mdi:router-network",
-  "mdi:text-box-search",
   "mdi:thermometer",
   "mdi:web",
   "mdi:weather-sunny",
diff --git a/apps/web/src/lib/dashboard-seed/dimensionlab.ts b/apps/web/src/lib/dashboard-seed/dimensionlab.ts
index 6cc544b..59162e6 100644
--- a/apps/web/src/lib/dashboard-seed/dimensionlab.ts
+++ b/apps/web/src/lib/dashboard-seed/dimensionlab.ts
@@ -431,14 +431,6 @@ export const dimensionLabDashboardFixture: DashboardDocument = {
         href: "https://models.dimensionlab.net",
         datasource: uptimeMonitor(7),
       }),
-      service({
-        id: "prompt-registry",
-        label: "Prompt Registry",
-        description: "Shared prompts, traces, evals",
-        icon: "mdi:text-box-search",
-        href: "https://prompts.dimensionlab.net",
-        datasource: uptimeMonitor(20),
-      }),
     ]),
     group("systems", "Systems", [
       service({
diff --git a/apps/web/src/lib/server/dashboard.test.ts b/apps/web/src/lib/server/dashboard.test.ts
index 7851ebb..5d93422 100644
--- a/apps/web/src/lib/server/dashboard.test.ts
+++ b/apps/web/src/lib/server/dashboard.test.ts
@@ -66,9 +66,6 @@ describe("dashboard runtime loader", () => {
     expect(runtime.document.statusStrips[0]?.items.map((item) => item.id)).toContain(
       "auto-refresh",
     );
-    expect(runtime.document.serviceGroups.flatMap((group) => group.services).map((service) => service.id)).toContain(
-      "prompt-registry",
-    );
     expect(store.listRevisions()).toHaveLength(2);
     expect(store.getActiveDashboard()?.revision.actor).toBe("initial-seed");
   });
@@ -138,13 +135,5 @@ function olderDimensionLabSeed() {
     ...strip,
     items: strip.items.filter((item) => item.id !== "auto-refresh"),
   }));
-  document.serviceGroups = document.serviceGroups.map((group) =>
-    group.id === "ai-automation"
-      ? {
-          ...group,
-          services: group.services.filter((service) => service.id !== "prompt-registry"),
-        }
-      : group,
-  );
   return document;
 }
diff --git a/apps/web/src/lib/workspace-boundary.test.ts b/apps/web/src/lib/workspace-boundary.test.ts
index 49f4cee..58cf203 100644
--- a/apps/web/src/lib/workspace-boundary.test.ts
+++ b/apps/web/src/lib/workspace-boundary.test.ts
@@ -275,10 +275,15 @@ describe("workspace boundaries", () => {
     expect(workflow).toContain("bun run test");
     expect(workflow).toContain("bun run build");
     expect(workflow).toContain("needs: ci");
-    expect(workflow).toContain("options: --security-opt label=disable");
+    expect(workflow).toContain("runs-on: deploy");
     expect(workflow).toContain("github.event_name == 'push'");
     expect(workflow).toContain("github.ref == 'refs/heads/main'");
-    expect(workflow).toContain("docker inspect dimensionlab-website");
+    expect(workflow).toContain(
+      "git remote add origin git@git.dimensionlab.net:vince/dimensionlab-website.git",
+    );
+    expect(workflow).toContain('git fetch --force --prune --depth=1 origin "$GITHUB_SHA"');
+    expect(workflow).toContain("podman inspect dimensionlab-website");
+    expect(workflow).toContain("DEPLOY_CONTAINER_CLI: podman");
     expect(workflow).toContain("PODMAN_SYSTEMD_UNIT");
     expect(workflow).toContain("scripts/deploy-dimensionlab-website.sh");
   });
diff --git a/apps/web/tests/e2e/dashboard.spec.ts b/apps/web/tests/e2e/dashboard.spec.ts
index 48eac8b..3eb0944 100644
--- a/apps/web/tests/e2e/dashboard.spec.ts
+++ b/apps/web/tests/e2e/dashboard.spec.ts
@@ -16,7 +16,6 @@ const linkedServiceIds = [
   "open-webui",
   "comfyui",
   "models",
-  "prompt-registry",
   "adminer",
   "assistant",
   "suna",
@@ -104,7 +103,7 @@ test.describe("dashboard page QA gate", () => {
     expect(metrics.runtimeBottom).toBeLessThanOrEqual(956);
     expect(metrics.footerBottom).toBeLessThanOrEqual(956);
     expect(metrics.telemetryCardCount).toBe(16);
-    expect(metrics.serviceRowCount).toBe(28);
+    expect(metrics.serviceRowCount).toBe(27);
     expect(metrics.footerCellCount).toBe(5);
     expect(metrics.clippedItems).toEqual([]);
   });
diff --git a/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-desktop-chromium-desktop-linux.png b/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-desktop-chromium-desktop-linux.png
index c548a8a..a1c0ada 100644
Binary files a/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-desktop-chromium-desktop-linux.png and b/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-desktop-chromium-desktop-linux.png differ
diff --git a/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-light-desktop-chromium-desktop-linux.png b/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-light-desktop-chromium-desktop-linux.png
index a007213..f5d5163 100644
Binary files a/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-light-desktop-chromium-desktop-linux.png and b/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-light-desktop-chromium-desktop-linux.png differ
diff --git a/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-mobile-chromium-mobile-linux.png b/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-mobile-chromium-mobile-linux.png
index 0542e73..48293a4 100644
Binary files a/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-mobile-chromium-mobile-linux.png and b/apps/web/tests/e2e/dashboard.spec.ts-snapshots/dashboard-mobile-chromium-mobile-linux.png differ