diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index 11c4567..dbb7705 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -38,13 +38,6 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       # Log into the Gitea Container Registry except on PR.
-      #
-      # NOTE: Gitea's automatic Actions token (secrets.GITHUB_TOKEN) is NOT
-      # granted package scope, so it cannot push to the container registry.
-      # Create a Gitea personal access token with the "write:package" scope
-      # (Settings -> Applications -> Access Tokens) and add it as a repo/org
-      # Actions secret named PACKAGES_TOKEN. Set PACKAGES_USER to the token
-      # owner's username (defaults to the triggering actor).
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
@@ -69,35 +62,4 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          # NOTE: type=gha cache is intentionally omitted. Gitea's act_runner cache
-          # service is not reachable from the buildx container on this instance, so
-          # cache import timed out (~30s) on every run. The Dockerfile's BuildKit
-          # cache mounts still speed up dependency installs within a build.
           platforms: linux/amd64
-
-      # Tell Arcane to pull the freshly-pushed image and recreate the container.
-      #
-      # Create the webhook in Arcane: Settings -> Webhooks -> New, targeting the
-      # compose PROJECT with the "update" action (pulls new images + recreates
-      # changed services). Arcane shows the token (arc_wh_...) exactly once; the
-      # full trigger URL is
-      #   https://<arcane-host>/api/webhooks/trigger/arc_wh_xxxxxxxx...
-      # Store that whole URL as the Actions secret ARCANE_WEBHOOK_URL. The
-      # endpoint is unauthenticated apart from the token in the path (rate-limited
-      # to 60 req / 10s per IP), takes no body, and only fires on real pushes to
-      # main — not on PRs, and skipped automatically if the secret is unset.
-      - name: Trigger Arcane deployment
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        env:
-          ARCANE_WEBHOOK_URL: ${{ secrets.ARCANE_WEBHOOK_URL }}
-        run: |
-          if [ -z "$ARCANE_WEBHOOK_URL" ]; then
-            echo "ARCANE_WEBHOOK_URL not set; skipping deploy trigger."
-            exit 0
-          fi
-          code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST "$ARCANE_WEBHOOK_URL")
-          echo "Arcane webhook responded with HTTP $code"
-          case "$code" in
-            2*) echo "Deployment triggered." ;;
-            *)  echo "::error::Arcane webhook failed (HTTP $code)"; exit 1 ;;
-          esac