diff --git a/servers/legion/apps/gitea-runner.yaml b/servers/legion/apps/gitea-runner.yaml
index 5e0227e..fcf8e57 100644
--- a/servers/legion/apps/gitea-runner.yaml
+++ b/servers/legion/apps/gitea-runner.yaml
@@ -38,6 +38,7 @@ spec:
                 network: host
                 docker_host: "unix:///var/run/docker.sock"
                 force_pull: false
+                options: -v /usr/local/bin/kubectl:/usr/local/bin/kubectl:ro
               EOF
           envFrom:
             - secretRef:
diff --git a/servers/legion/ingress.tf b/servers/legion/ingress.tf
index 065131c..c491e84 100644
--- a/servers/legion/ingress.tf
+++ b/servers/legion/ingress.tf
@@ -42,18 +42,22 @@ resource "kubernetes_ingress_v1" "registry" {
     name      = "registry"
     namespace = kubernetes_namespace.registry.metadata[0].name
     annotations = {
-      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
-      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+      "traefik.ingress.kubernetes.io/router.entrypoints"        = "websecure"
+      "cert-manager.io/cluster-issuer"                          = "letsencrypt-prod"
+      "traefik.ingress.kubernetes.io/router.middlewares"        = "registry-chunked@kubernetescrd"
+      "nginx.ingress.kubernetes.io/proxy-body-size"             = "0"
+      "nginx.ingress.kubernetes.io/proxy-read-timeout"          = "600"
+      "nginx.ingress.kubernetes.io/proxy-send-timeout"          = "600"
     }
   }
 
   spec {
     tls {
-      hosts       = ["registry.${var.domain_suffix}"]
+      hosts       = ["registry.${var.infra_domain}"]
       secret_name = "registry-tls"
     }
     rule {
-      host = "registry.${var.domain_suffix}"
+      host = "registry.${var.infra_domain}"
       http {
         path {
           path      = "/"