diff --git a/servers/legion/k8s/gitea-runner/deployment.yaml b/servers/legion/k8s/gitea-runner/deployment.yaml
index 6a32df9..1ec8d3c 100644
--- a/servers/legion/k8s/gitea-runner/deployment.yaml
+++ b/servers/legion/k8s/gitea-runner/deployment.yaml
@@ -8,7 +8,7 @@ metadata:
   labels:
     app: gitea-runner
   annotations:
-    config-version: "2026-05-04-docker-sock-fix"
+    config-version: "2026-05-04-public-instance-url"
 spec:
   replicas: 1
   selector:
@@ -19,7 +19,7 @@ spec:
       labels:
         app: gitea-runner
       annotations:
-        config-version: "2026-05-04-docker-sock-fix"
+        config-version: "2026-05-04-public-instance-url"
     spec:
       securityContext:
         runAsNonRoot: false
@@ -92,7 +92,7 @@ metadata:
   labels:
     app: neuron-technologies-runner
   annotations:
-    config-version: "2026-05-04-docker-sock-fix"
+    config-version: "2026-05-04-public-instance-url"
 spec:
   replicas: 2
   selector:
@@ -103,7 +103,7 @@ spec:
       labels:
         app: neuron-technologies-runner
       annotations:
-        config-version: "2026-05-04-docker-sock-fix"
+        config-version: "2026-05-04-public-instance-url"
     spec:
       securityContext:
         runAsNonRoot: false
diff --git a/servers/legion/k8s/gitea-runner/external-secrets.yaml b/servers/legion/k8s/gitea-runner/external-secrets.yaml
index e5ac5d1..c6efaf1 100644
--- a/servers/legion/k8s/gitea-runner/external-secrets.yaml
+++ b/servers/legion/k8s/gitea-runner/external-secrets.yaml
@@ -17,7 +17,13 @@ spec:
     creationPolicy: Owner
     template:
       data:
-        GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
+        # Public URL — the in-cluster name (gitea.git.svc.cluster.local) is
+        # not resolvable from build containers running with `network: host`,
+        # which causes `git fetch` to fail at the very first checkout step.
+        # The runner polls Gitea over Cloudflare; the latency cost is small
+        # and the build container's clone URL is derived from this instance,
+        # so it has to be a name the build container can resolve.
+        GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
         GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
   data:
     - secretKey: runner_token
@@ -41,7 +47,8 @@ spec:
     creationPolicy: Owner
     template:
       data:
-        GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
+        # Public URL — see commentary on the gitea-runner-secret above.
+        GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
         GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
   data:
     - secretKey: runner_token