diff --git a/.gitea/workflows/image-only.yml b/.gitea/workflows/image-only.yml
index 01fd5eb..e33d711 100644
--- a/.gitea/workflows/image-only.yml
+++ b/.gitea/workflows/image-only.yml
@@ -18,7 +18,9 @@ env:
   # body cap. PULL uses the public hostname (HTTPS). Same Gitea registry.
   REGISTRY_PUSH: 192.168.0.2:1234
   REGISTRY_PULL: git.jpaul.io
-  IMAGE: ${{ github.repository_owner }}/${{ github.event.repository.name }}
+  # Image name resolved at runtime from $GITHUB_REPOSITORY (see the "Resolve
+  # repo identity" step). github.event.repository.name is empty on non-
+  # workflow_dispatch events in Gitea, so it's avoided (matches refresh.yml).
   # Two GPU-pinned Ollama containers on the Gitea host — same infra
   # zerto-docs uses. :11435 = Titan X, :11436 = 1080 Ti. Indexer
   # round-robins per batch.
@@ -38,6 +40,15 @@ jobs:
           # Full history so digest-history can walk git log.
           fetch-depth: 0
 
+      # Derive owner/repo from $GITHUB_REPOSITORY (set on all event types),
+      # not github.event.repository.name (empty on non-dispatch events).
+      - name: Resolve repo identity
+        id: repo
+        run: |
+          echo "owner=${GITHUB_REPOSITORY%%/*}" >> "$GITHUB_OUTPUT"
+          echo "name=${GITHUB_REPOSITORY##*/}"  >> "$GITHUB_OUTPUT"
+          echo "resolved repo identity: ${GITHUB_REPOSITORY}"
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -95,14 +106,14 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: 192.168.0.2:1234/${{ github.repository_owner }}/${{ github.event.repository.name }}
+          images: 192.168.0.2:1234/${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}
           tags: |
             type=raw,value=latest
             type=sha,prefix=,format=short
             type=raw,value={{date 'YYYY.MM.DD'}}
           labels: |
-            org.opencontainers.image.source=https://git.jpaul.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
-            org.opencontainers.image.url=https://git.jpaul.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
+            org.opencontainers.image.source=https://git.jpaul.io/${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}
+            org.opencontainers.image.url=https://git.jpaul.io/${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}
 
       - name: Build & push (amd64)
         uses: docker/build-push-action@v6
@@ -117,8 +128,8 @@ jobs:
         env:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          OWNER="${{ github.repository_owner }}"
-          PKG="${{ github.event.repository.name }}"
+          OWNER="${{ steps.repo.outputs.owner }}"
+          PKG="${{ steps.repo.outputs.name }}"
           code=$(curl -s -o /tmp/link.out -w "%{http_code}" -X POST \
             -H "Authorization: token ${GITEA_TOKEN}" \
             "https://git.jpaul.io/api/v1/packages/${OWNER}/container/${PKG}/-/link/${PKG}")
@@ -135,7 +146,7 @@ jobs:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           python scripts/registry_gc.py \
-            --owner "${{ github.repository_owner }}" \
-            --package "${{ github.event.repository.name }}" \
+            --owner "${{ steps.repo.outputs.owner }}" \
+            --package "${{ steps.repo.outputs.name }}" \
             --keep-days 90 \
             --keep-latest 5
diff --git a/.gitea/workflows/refresh.yml b/.gitea/workflows/refresh.yml
index 22d9cf6..e0d0e6b 100644
--- a/.gitea/workflows/refresh.yml
+++ b/.gitea/workflows/refresh.yml
@@ -25,9 +25,11 @@ env:
   REGISTRY_PUSH: 192.168.0.2:1234
   REGISTRY_PULL: git.jpaul.io
 
-  # Image name derives from the repo at runtime — clones don't need to
-  # edit this. github.* is the Gitea-Actions inherited namespace.
-  IMAGE: ${{ github.repository_owner }}/${{ github.event.repository.name }}
+  # Image name is derived at runtime by the "Resolve repo identity" step
+  # from $GITHUB_REPOSITORY. Do NOT use github.event.repository.name — Gitea
+  # leaves it EMPTY on schedule events (only workflow_dispatch populates it),
+  # which produced invalid tags like ".../justin/:latest" and failed the
+  # weekly cron build. $GITHUB_REPOSITORY is set on every event type.
 
   # Two GPU-pinned Ollama containers on the Gitea host — same infra
   # zerto-docs uses (deploy/ollama-rag.docker-compose.yml over there).
@@ -67,6 +69,16 @@ jobs:
           # commits back. Persist them across the run.
           token: ${{ secrets.GITEA_TOKEN }}
 
+      # Derive owner/repo from $GITHUB_REPOSITORY (set on ALL event types),
+      # NOT from github.event.repository.name (empty on schedule events in
+      # Gitea). Everything downstream references these outputs.
+      - name: Resolve repo identity
+        id: repo
+        run: |
+          echo "owner=${GITHUB_REPOSITORY%%/*}" >> "$GITHUB_OUTPUT"
+          echo "name=${GITHUB_REPOSITORY##*/}"  >> "$GITHUB_OUTPUT"
+          echo "resolved repo identity: ${GITHUB_REPOSITORY}"
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -187,7 +199,7 @@ jobs:
         with:
           # Tag with the LAN hostname so the push goes over LAN.
           # docker-compose on the deploy host pulls via git.jpaul.io.
-          images: 192.168.0.2:1234/${{ github.repository_owner }}/${{ github.event.repository.name }}
+          images: 192.168.0.2:1234/${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}
           tags: |
             type=raw,value=latest
             type=sha,prefix=,format=short
@@ -196,8 +208,8 @@ jobs:
           # Override auto-derived labels with the PUBLIC URL so Gitea
           # can auto-link the package back to this repo.
           labels: |
-            org.opencontainers.image.source=https://git.jpaul.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
-            org.opencontainers.image.url=https://git.jpaul.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
+            org.opencontainers.image.source=https://git.jpaul.io/${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}
+            org.opencontainers.image.url=https://git.jpaul.io/${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}
 
       - name: Build & push (amd64)
         if: steps.commit.outputs.changed == 'true' || inputs.force_build == true
@@ -219,8 +231,8 @@ jobs:
         env:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          OWNER="${{ github.repository_owner }}"
-          PKG="${{ github.event.repository.name }}"
+          OWNER="${{ steps.repo.outputs.owner }}"
+          PKG="${{ steps.repo.outputs.name }}"
           code=$(curl -s -o /tmp/link.out -w "%{http_code}" -X POST \
             -H "Authorization: token ${GITEA_TOKEN}" \
             "https://git.jpaul.io/api/v1/packages/${OWNER}/container/${PKG}/-/link/${PKG}")
@@ -239,7 +251,7 @@ jobs:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           python scripts/registry_gc.py \
-            --owner "${{ github.repository_owner }}" \
-            --package "${{ github.event.repository.name }}" \
+            --owner "${{ steps.repo.outputs.owner }}" \
+            --package "${{ steps.repo.outputs.name }}" \
             --keep-days 90 \
             --keep-latest 5