diff --git a/overlays/local/kustomization.yaml b/overlays/local/kustomization.yaml
index 16c631f..4b6cbc9 100644
--- a/overlays/local/kustomization.yaml
+++ b/overlays/local/kustomization.yaml
@@ -22,12 +22,11 @@ resources:
   - ../../base/vso
 
 images:
-  # Local dev: sunbeam-proxy is built and imported directly into k3s containerd.
-  # imagePullPolicy: Never is set in values-pingora.yaml so k3s never tries to pull.
-  # Production overlay points this at src.DOMAIN_SUFFIX/studio/sunbeam-proxy:latest.
+  # Pulled from our Gitea registry. Built and pushed by: sunbeam.py --build
+  # imagePullPolicy: Always in values-pingora.yaml ensures each rollout pulls fresh.
   - name: sunbeam-proxy
-    newName: sunbeam-proxy
-    newTag: dev
+    newName: src.DOMAIN_SUFFIX/studio/sunbeam-proxy
+    newTag: latest
 
   # amd64-only La Suite images — mirrored to our Gitea registry with a patched
   # OCI index that adds an arm64 alias so Rosetta can run them on the Lima VM.
diff --git a/overlays/local/values-pingora.yaml b/overlays/local/values-pingora.yaml
index 7b12271..04a8c85 100644
--- a/overlays/local/values-pingora.yaml
+++ b/overlays/local/values-pingora.yaml
@@ -12,7 +12,7 @@ spec:
     spec:
       containers:
         - name: pingora
-          imagePullPolicy: Never
+          imagePullPolicy: Always
           ports:
             # Bind HTTP/HTTPS directly to the Lima VM's host network
             - name: http