diff --git a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
index 99ef5eb..90ac4b7 100644
--- a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
+++ b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
@@ -78,6 +78,18 @@ ingress:
   className: nginx
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
+    # This chart Ingress and the hand-written one in
+    # k8s/bootstrap/ingress/ingress.yaml both claim forgejo.riotpiao.com.
+    # ingress-nginx breaks the tie by oldest creationTimestamp, and the chart's
+    # is older, so it is the one actually serving — the annotations on the other
+    # have never applied. Duplicate should be removed; until then these must
+    # live here or they do nothing.
+    #
+    # proxy-body-size 0 is required for the OCI registry: nginx defaults to 1m,
+    # so any image layer above that fails the push with 413.
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
   hosts:
     - host: forgejo.riotpiao.com
       paths: