diff --git a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
index fefb458..e02befc 100644
--- a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
+++ b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
@@ -45,7 +45,13 @@ gitea:
       SSH_DOMAIN: git.riotpiao.com
       SSH_PORT: 2222
       SSH_LISTEN_PORT: 2222
-      
+
+    # Self-signup was open (GET /user/sign_up returned 200), so anyone reaching
+    # forgejo.riotpiao.com could create an account. Accounts are provisioned by
+    # the admin only; admin create-user via UI/API is unaffected by this flag.
+    service:
+      DISABLE_REGISTRATION: true
+
     database:
       DB_TYPE: postgres
       HOST: forgejo-db-rw.cicd.svc.cluster.local:5432