diff --git a/.gitea/workflows/deploy-dokploy.yml b/.gitea/workflows/deploy-dokploy.yml
index dbb05ff..ad0a9f7 100644
--- a/.gitea/workflows/deploy-dokploy.yml
+++ b/.gitea/workflows/deploy-dokploy.yml
@@ -16,35 +16,17 @@ jobs:
       - name: Upload source and wait for Dokploy build
         shell: bash
         env:
-          DOKPLOY_URL: ${{ secrets.DOKPLOY_URL }}
           DOKPLOY_API_KEY: ${{ secrets.DOKPLOY_API_KEY }}
           DOKPLOY_APPLICATION_ID: ${{ secrets.DOKPLOY_APPLICATION_ID }}
         run: |
           set -eu
           umask 077
 
-          : "${DOKPLOY_URL:?Add the DOKPLOY_URL Actions secret.}"
+          # Pin the deployment origin; runner variables and .env cannot override it.
+          readonly DOKPLOY_URL='https://dokploy.minegeo.site'
           : "${DOKPLOY_API_KEY:?Add the DOKPLOY_API_KEY Actions secret.}"
           : "${DOKPLOY_APPLICATION_ID:?Add the DOKPLOY_APPLICATION_ID Actions secret.}"
 
-          DOKPLOY_URL="${DOKPLOY_URL%/}"
-          case "$DOKPLOY_URL" in
-            https://*) ;;
-            http://78.153.139.142:3000)
-              echo "::warning::DOKPLOY_URL uses plain HTTP; the API key and source travel unencrypted until a TLS domain is configured."
-              ;;
-            *)
-              echo "DOKPLOY_URL must use HTTPS (or the pinned http://78.153.139.142:3000 until a domain exists)." >&2
-              exit 1
-              ;;
-          esac
-          case "${DOKPLOY_URL#*://}" in
-            */*|*\?*|*\#*|*@*)
-              echo "DOKPLOY_URL must be the HTTPS origin only, without a path or credentials." >&2
-              exit 1
-              ;;
-          esac
-
           temp_root="${RUNNER_TEMP:-/tmp}"
           mkdir -p "$temp_root"
           auth_file="$(mktemp "$temp_root/minegeo-dokploy-auth.XXXXXX")"
diff --git a/docs/dokploy-deployment.md b/docs/dokploy-deployment.md
index ff2165d..4890c89 100644
--- a/docs/dokploy-deployment.md
+++ b/docs/dokploy-deployment.md
@@ -93,10 +93,11 @@ private image-transfer or private-registry workflow.
 
 ## Gitea Actions secrets
 
-Add the following repository Actions secrets in Gitea. Use the HTTPS origin of
-Dokploy for `DOKPLOY_URL`, without `/api` or a trailing path.
+Add the following repository Actions secrets in Gitea. The workflow pins Dokploy
+to `https://dokploy.minegeo.site` with a readonly shell assignment. Environment
+variables, `.env` files, and any existing `DOKPLOY_URL` secret cannot override
+that address. Changing the deployment domain requires editing the workflow.
 
-- `DOKPLOY_URL`
 - `DOKPLOY_API_KEY` (create this in Dokploy)
 - `DOKPLOY_APPLICATION_ID` (copy this from the target Application)