diff --git a/stacks/f1-stream/main.tf b/stacks/f1-stream/main.tf
index 7666458d..11ff8cd4 100644
--- a/stacks/f1-stream/main.tf
+++ b/stacks/f1-stream/main.tf
@@ -128,7 +128,7 @@ resource "kubernetes_deployment" "f1-stream" {
       }
       spec {
         container {
-          image             = "forgejo.viktorbarzin.me/viktor/f1-stream:${var.image_tag}"
+          image             = "ghcr.io/viktorbarzin/f1-stream:${var.image_tag}"
           image_pull_policy = "Always"
           name              = "f1-stream"
           # Right-sized 2026-06-05: was 1Gi (bundled-Chromium era). The image is
diff --git a/stacks/openclaw/main.tf b/stacks/openclaw/main.tf
index 5a142af2..925c6675 100644
--- a/stacks/openclaw/main.tf
+++ b/stacks/openclaw/main.tf
@@ -553,7 +553,7 @@ resource "kubernetes_deployment" "openclaw" {
           # IfNotPresent: a cached stale :latest meant the plugin manifest
           # (configSchema fix) never got pulled. An uncached SHA forces the
           # pull. Bump this when the openclaw plugin in nextcloud-todos changes.
-          image             = "forgejo.viktorbarzin.me/viktor/nextcloud-todos:f85c6de1"
+          image             = "ghcr.io/viktorbarzin/nextcloud-todos:latest"
           image_pull_policy = "Always"
           command = ["sh", "-c", <<-EOT
             set -eu