diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 4b75071..07dc36c 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -39,6 +39,7 @@ jobs:
         run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
 
       - name: Registry login
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
             --username "${REGISTRY_USER}" --password-stdin
@@ -47,87 +48,143 @@ jobs:
           REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
       - name: Build Docker image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
             -f Dockerfile .
 
       - name: Push image (SHA tag)
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      # ── Tekton integration tests ─────────────────────────────
+      # ── Deploy canary pod + integration test ────────────────
+      # Canary pod runs in-cluster with real secrets and real upstreams
+      # (Temporal, Gotify). Tests run against its pod IP directly.
+      # Zero downtime: production pods untouched until tests pass.
       - name: Setup kubeconfig
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           mkdir -p ~/.kube
           echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
-          kubectl get pipelineruns -n api --no-headers | head -1 || echo 'No PipelineRuns yet'
+          kubectl get nodes --no-headers | head -1
           echo '✓ kubeconfig works'
         env:
           KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
 
-      - name: Trigger Tekton PipelineRun
-        id: tekton
+      - name: Deploy canary pod
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        id: canary
         run: |
           SHA="${{ steps.sha.outputs.short_sha }}"
-          RUN_NAME="integration-test-${SHA}"
+          POD_NAME="api-gateway-canary-${SHA}"
 
-          # Clean up any previous run with the same name
-          kubectl delete taskrun "${RUN_NAME}" -n api --ignore-not-found
+          # Remove any stale canary
+          kubectl delete pod "${POD_NAME}" -n api --ignore-not-found
 
-          # Create TaskRun — spins up gateway sidecar + curl tests
-          cat <<YAML | kubectl create -f -
-          apiVersion: tekton.dev/v1
-          kind: TaskRun
-          metadata:
-            name: ${RUN_NAME}
-            namespace: api
-            labels:
-              commit-sha: "${SHA}"
-          spec:
-            taskRef:
-              name: integration-test
-            params:
-            - name: image
-              value: "${IMAGE}:${SHA}"
-          YAML
+          # Create canary pod with real secrets + config
+          kubectl run "${POD_NAME}" \
+            --image="${IMAGE}:${SHA}" \
+            --restart=Never \
+            --namespace=api \
+            --labels="app=api-gateway-canary,sha=${SHA}" \
+            --overrides="$(cat <<JSON
+          {
+            "spec": {
+              "imagePullSecrets": [{"name": "forgejo-registry"}],
+              "volumes": [
+                {"name": "config", "secret": {"secretName": "api-gateway-config"}}
+              ],
+              "containers": [{
+                "name": "${POD_NAME}",
+                "image": "${IMAGE}:${SHA}",
+                "imagePullPolicy": "Always",
+                "env": [
+                  {"name": "LISTEN_ADDR",   "value": "0.0.0.0:8080"},
+                  {"name": "CONFIG_PATH",   "value": "/etc/gateway/config.yaml"},
+                  {"name": "LOG_LEVEL",     "value": "info"},
+                  {"name": "GOTIFY_URL",           "valueFrom": {"secretKeyRef": {"name": "gotify-webhook-secret", "key": "gotify-url",              "optional": true}}},
+                  {"name": "GOTIFY_APP_TOKEN",     "valueFrom": {"secretKeyRef": {"name": "gotify-webhook-secret", "key": "gotify-app-token",        "optional": true}}},
+                  {"name": "FORGEJO_WEBHOOK_SECRET","valueFrom": {"secretKeyRef": {"name": "gotify-webhook-secret", "key": "forgejo-webhook-secret", "optional": true}}},
+                  {"name": "AUTH_CLIENT_SECRET",   "valueFrom": {"secretKeyRef": {"name": "api-gw-client-secret",  "key": "client-secret",          "optional": true}}}
+                ],
+                "volumeMounts": [
+                  {"name": "config", "mountPath": "/etc/gateway", "readOnly": true}
+                ],
+                "readinessProbe": {
+                  "httpGet": {"path": "/healthz", "port": 8080},
+                  "initialDelaySeconds": 3,
+                  "periodSeconds": 2
+                }
+              }]
+            }
+          }
+          JSON
+          )"
 
-          echo "✓ TaskRun created: ${RUN_NAME}"
+          echo "✓ Canary pod created: ${POD_NAME}"
 
-          # Wait for completion (Succeeded or Failed)
-          echo "Waiting for tests (timeout 5m)..."
-          if kubectl wait taskrun/"${RUN_NAME}" -n api \
-               --for=condition=Succeeded --timeout=5m 2>/dev/null; then
-            echo "result=pass" >> $GITHUB_OUTPUT
-          else
-            echo "result=fail" >> $GITHUB_OUTPUT
-          fi
+          # Wait for pod to be ready (real secrets, real upstreams)
+          kubectl wait pod/"${POD_NAME}" -n api \
+            --for=condition=Ready --timeout=90s
 
-          # Print logs + results
-          echo ""
-          echo "=== Test Logs ==="
-          POD=$(kubectl get pod -n api -l tekton.dev/taskRun=${RUN_NAME} -o name | head -1)
-          kubectl logs -n api "${POD}" -c step-run-tests 2>/dev/null || true
-          echo ""
-          REASON=$(kubectl get taskrun "${RUN_NAME}" -n api \
-            -o jsonpath='{.status.conditions[0].reason}')
-          SUMMARY=$(kubectl get taskrun "${RUN_NAME}" -n api \
-            -o jsonpath='{.status.results[?(@.name=="summary")].value}')
-          echo "Status: ${REASON}"
+          # Capture pod IP for test runner
+          POD_IP=$(kubectl get pod "${POD_NAME}" -n api \
+            -o jsonpath='{.status.podIP}')
+          echo "pod_name=${POD_NAME}" >> $GITHUB_OUTPUT
+          echo "pod_ip=${POD_IP}"     >> $GITHUB_OUTPUT
+          echo "✓ Canary ready at ${POD_IP}:8080"
+
+      - name: Run integration tests against canary
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        id: tests
+        run: |
+          POD_IP="${{ steps.canary.outputs.pod_ip }}"
+          GW="http://${POD_IP}:8080"
+          RESULTS_DIR="/tmp/test-results"
+          mkdir -p "${RESULTS_DIR}"
+
+          echo "Running integration tests against canary at ${GW}..."
+          sh k8s/tekton/scripts/integration-test.sh
+
+          RESULT=$(cat "${RESULTS_DIR}/result" 2>/dev/null || echo "fail")
+          SUMMARY=$(cat "${RESULTS_DIR}/summary" 2>/dev/null || echo "unknown")
+          echo "Result: ${RESULT}"
           echo "Summary: ${SUMMARY}"
+          echo "result=${RESULT}" >> $GITHUB_OUTPUT
+
+      - name: Cleanup canary pod
+        if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          POD_NAME="${{ steps.canary.outputs.pod_name }}"
+          kubectl delete pod "${POD_NAME}" -n api --ignore-not-found || true
+          echo "✓ Canary pod removed"
 
       - name: Gate on test result
-        if: steps.tekton.outputs.result != 'pass'
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && steps.tests.outputs.result != 'pass'
         run: |
-          echo "✗ Integration tests FAILED — image NOT promoted"
+          echo "✗ Integration tests FAILED — production deployment unchanged"
           exit 1
 
-      # ── Promote only after tests pass ────────────────────────
-      - name: Promote image to latest
+      # ── Zero-downtime promotion ──────────────────────────────
+      # kubectl set image triggers a rolling update: new pods come up
+      # before old pods are terminated. Production traffic uninterrupted.
+      - name: Promote — rolling update
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          SHA="${{ steps.sha.outputs.short_sha }}"
+          kubectl set image deployment/api-gateway \
+            api-gateway="${IMAGE}:${SHA}" -n api
+          kubectl rollout status deployment/api-gateway -n api --timeout=120s
+          echo "✓ Rolling update complete: ${IMAGE}:${SHA}"
+
+      - name: Tag :latest (informational)
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
           docker push "${IMAGE}:latest"
-          echo "✓ Promoted to latest"
+          echo "✓ Tagged :latest"
 
-      - name: Cleanup
+      - name: Cleanup docker images
         if: always()
         run: docker image prune -af 2>&1 | tail -3 || true
diff --git a/k8s/tekton/scripts/integration-test.sh b/k8s/tekton/scripts/integration-test.sh
index af8bd94..bc2018e 100755
--- a/k8s/tekton/scripts/integration-test.sh
+++ b/k8s/tekton/scripts/integration-test.sh
@@ -2,11 +2,12 @@
 set -e
 
 # Integration test runner for API gateway.
-# Tests X-Service + X-Resource header routing against a gateway on localhost.
+# Runs against a real canary pod in-cluster (has real secrets + upstreams).
+# GW env var must be set: e.g. http://10.244.1.5:8080
 #
 # Required env:
-#   GW           — gateway base URL (e.g. http://localhost:8080)
-#   RESULTS_DIR  — directory to write Tekton results
+#   GW           — gateway base URL
+#   RESULTS_DIR  — directory to write result/summary files
 
 PASS=0; FAIL=0; TOTAL=0
 
@@ -25,28 +26,23 @@ assert() {
   fi
 }
 
-# ── Wait for sidecar gateway ──
-echo "⏳ Waiting for gateway sidecar..."
+# ── Wait for gateway ──────────────────────────────────────────────────────────
+echo "⏳ Waiting for gateway at ${GW}..."
 READY=false
-for i in $(seq 1 60); do
+for i in $(seq 1 30); do
   CODE=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
   if [ "$CODE" = "200" ]; then
-    sleep 1
-    C2=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
-    C3=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
-    if [ "$C2" = "200" ] && [ "$C3" = "200" ]; then
-      READY=true
-      echo "✓ Gateway ready"
-      break
-    fi
+    READY=true
+    echo "✓ Gateway ready"
+    break
   fi
   sleep 2
 done
 
 if [ "$READY" = "false" ]; then
   echo "✗ Gateway never became ready"
-  echo "fail" > "${RESULTS_DIR}/result"
-  echo "0/0 gateway timeout" > "${RESULTS_DIR}/summary"
+  echo "fail"    > "${RESULTS_DIR}/result"
+  echo "0/0 timeout" > "${RESULTS_DIR}/summary"
   exit 1
 fi
 
@@ -54,99 +50,71 @@ echo ""
 echo "═══ Integration Tests ═══"
 echo ""
 
-# ── Health ──
+# ── Health ────────────────────────────────────────────────────────────────────
 echo "▸ Health"
-assert "GET /healthz" 200  -X GET "${GW}/healthz"
-assert "GET /readyz"  200  -X GET "${GW}/readyz"
+assert "GET /healthz" 200 -X GET "${GW}/healthz"
+assert "GET /readyz"  200 -X GET "${GW}/readyz"
 
-# ── Header validation ──
+# ── Header validation ─────────────────────────────────────────────────────────
 echo "▸ Header validation"
 assert "X-Service without X-Resource → 400" 400 \
   -X GET -H "X-Service: memory" "${GW}/"
 assert "unknown service → 404" 404 \
   -X GET -H "X-Service: nonexistent" -H "X-Resource: foo" "${GW}/"
 
-# ── S3 (no auth, MinIO rejects → 403) ──
+# ── S3 (no auth, MinIO rejects → 403) ────────────────────────────────────────
 echo "▸ S3 service"
-assert "s3/list-objects" 403 \
+assert "s3/list-objects → 403" 403 \
   -X GET -H "X-Service: s3" -H "X-Resource: list-objects" "${GW}/"
 
-# ── SQS (auth required → 401) ──
+# ── SQS (auth required → 401) ─────────────────────────────────────────────────
 echo "▸ SQS service"
-assert "sqs/list-queues" 401 \
+assert "sqs/list-queues → 401" 401 \
   -X GET -H "X-Service: sqs" -H "X-Resource: list-queues" "${GW}/"
 
-# ── Workflow visibility (namespace pass-down) ──
+# ── Workflow ──────────────────────────────────────────────────────────────────
 echo "▸ Workflow service"
 
-# Test 1: List workflows in poimen-harness namespace (should see 4 terminated workflows)
-echo "  Testing workflow visibility in poimen-harness namespace..."
-WF_LIST=$(curl -s -X POST \
+# List with namespace — real Temporal call.
+# 200 = Temporal reachable, 503 = Temporal down but gateway routed correctly.
+echo "  Testing workflow list (poimen-harness namespace)..."
+WF_LIST=$(curl -s \
   -H "X-Service: workflow" \
   -H "X-Resource: list" \
   -H "Content-Type: application/json" \
   -d '{"namespace": "poimen-harness"}' \
   "${GW}/" 2>/dev/null || echo '{}')
 
-# Accept executions (Temporal reachable) or TEMPORAL_UNAVAILABLE (no Temporal in CI sidecar).
-# Both mean the gateway correctly routed the request — not a stub return.
+TOTAL=$((TOTAL + 1))
 if echo "$WF_LIST" | grep -qE '"executions"|"TEMPORAL_UNAVAILABLE"'; then
-  echo "  ✓ Workflow list: gateway routed correctly"
+  echo "  ✓ workflow/list responded correctly"
   PASS=$((PASS + 1))
 else
-  echo "  ✗ Workflow list: unexpected response: $WF_LIST"
+  echo "  ✗ workflow/list unexpected: $WF_LIST"
   FAIL=$((FAIL + 1))
 fi
-TOTAL=$((TOTAL + 1))
 
-# Test 2: Verify we can query terminated workflows
-echo "  Testing terminated workflow visibility..."
-if echo "$WF_LIST" | grep -q '"Completed\|"status"'; then
-  echo "  ✓ Found completed/terminated workflows in response"
-  PASS=$((PASS + 1))
-else
-  echo "  ⚠ No terminated workflows found in response (may be empty namespace)"
-  # Don't fail if namespace is empty - just note it
-fi
-TOTAL=$((TOTAL + 1))
-
-# Test 3: Verify namespace is required (missing namespace → 400)
-echo "  Testing namespace validation..."
-NO_NS=$(curl -s -w '%{http_code}' -X POST \
+# Namespace is required — canary pod has real WorkflowAdapter → must return 400
+assert "workflow/list without namespace → 400" 400 \
+  -X POST \
   -H "X-Service: workflow" \
   -H "X-Resource: list" \
   -H "Content-Type: application/json" \
   -d '{}' \
-  "${GW}/" 2>/dev/null || echo "000")
+  "${GW}/"
 
-if [ "$NO_NS" = "400" ] || [ "$NO_NS" = "404" ]; then
-  echo "  ✓ Namespace validation: got ${NO_NS} (400=enforced 404=old image)"
-  PASS=$((PASS + 1))
-else
-  echo "  ✗ Unexpected code for missing namespace, got $NO_NS"
-  FAIL=$((FAIL + 1))
-fi
-TOTAL=$((TOTAL + 1))
+# ── Forgejo webhook ───────────────────────────────────────────────────────────
+echo "▸ Forgejo webhook"
+# Canary pod has real handler wired. No HMAC secret set (optional) → handler
+# skips verification and forwards to Gotify (or logs if Gotify unavailable).
+assert "POST /v1/webhooks/forgejo → 200" 200 \
+  -X POST \
+  -H "Content-Type: application/json" \
+  -H "X-Gitea-Event: push" \
+  -d '{"ref":"refs/heads/main","commits":[{"message":"test"}],"repository":{"full_name":"test/repo"},"sender":{"login":"ci"}}' \
+  "${GW}/v1/webhooks/forgejo"
 
 echo ""
-# ── Forgejo webhook ──
-# NOTE: old image returns 404 (endpoint not present), new image returns 200.
-# Accept both during rollout — test confirms routing is wired.
-echo "▸ Forgejo webhook"
-WH_CODE=$(curl -s -o /dev/null -w '%{http_code}' \
-  -X POST -H "Content-Type: application/json" \
-  -H "X-Gitea-Event: push" \
-  -d '{"ref":"refs/heads/main","commits":[],"repository":{"full_name":"test/repo"},"sender":{"login":"ci"}}' \
-  "${GW}/v1/webhooks/forgejo" 2>/dev/null || echo "000")
-TOTAL=$((TOTAL + 1))
-if [ "$WH_CODE" = "200" ] || [ "$WH_CODE" = "404" ]; then
-  echo "  ✓ /v1/webhooks/forgejo: ${WH_CODE} (200=live 404=old image)"
-  PASS=$((PASS + 1))
-else
-  echo "  ✗ /v1/webhooks/forgejo: unexpected ${WH_CODE}"
-  FAIL=$((FAIL + 1))
-fi
-
 echo "═══ Results: ${PASS}/${TOTAL} passed, ${FAIL} failed ═══"
 
 if [ "$FAIL" -eq 0 ]; then