diff --git a/gitea/README.md b/gitea/README.md
index 6f9e820..b650c83 100644
--- a/gitea/README.md
+++ b/gitea/README.md
@@ -26,6 +26,8 @@ itself.
 
 - **HTTPS only.** The proxy routes HTTP, not SSH, so Gitea's SSH server is
   disabled and the UI offers HTTPS clone URLs only.
+- **Registration disabled.** The instance is public, and open sign-up drew
+  spam accounts. Admins create users from the site administration page.
 - **One-hour clone timeout.** Gitea's defaults (600 s to migrate, 300 s to
   fetch) cut off multi-gigabyte repositories mid-clone, leaving empty mirrors
   that still hold gigabytes of unreachable packfiles. A client that calls the
@@ -38,7 +40,8 @@ itself.
 
 ## Usage
 
-Complete Gitea's first-run setup at `GITEA_ROOT_URL`, then create an access
+Complete Gitea's first-run setup at `GITEA_ROOT_URL`, creating the admin
+account there since sign-up is closed, then create an access
 token for any tool that mirrors into it.
 
 ## Storage
diff --git a/gitea/compose.yml b/gitea/compose.yml
index 628d80d..8eedb45 100644
--- a/gitea/compose.yml
+++ b/gitea/compose.yml
@@ -28,6 +28,7 @@ services:
       GITEA__database__USER: gitea
       GITEA__server__ROOT_URL: ${GITEA_ROOT_URL:?required}
       GITEA__server__DISABLE_SSH: "true"
+      GITEA__service__DISABLE_REGISTRATION: "true"
       GITEA__git_0X2E_timeout__MIGRATE: ${GITEA_CLONE_TIMEOUT:-3600}
       GITEA__git_0X2E_timeout__MIRROR: ${GITEA_CLONE_TIMEOUT:-3600}
     volumes: