diff --git a/.woodpecker/build-1.yml b/.woodpecker/build-1.yml
index 176f9ae..6a1b4bc 100644
--- a/.woodpecker/build-1.yml
+++ b/.woodpecker/build-1.yml
@@ -10,17 +10,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/scheduler
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -51,17 +43,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/symbol-registry
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -96,17 +80,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/ingestion
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -141,17 +117,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/parser
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
diff --git a/.woodpecker/build-2.yml b/.woodpecker/build-2.yml
index 47f5b76..3f19aa4 100644
--- a/.woodpecker/build-2.yml
+++ b/.woodpecker/build-2.yml
@@ -10,17 +10,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/extractor
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -55,17 +47,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/aggregation
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -100,17 +84,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/recommendation
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -145,17 +121,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/signal-engine
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -190,17 +158,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/risk
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
diff --git a/.woodpecker/build-3.yml b/.woodpecker/build-3.yml
index c223178..da629bd 100644
--- a/.woodpecker/build-3.yml
+++ b/.woodpecker/build-3.yml
@@ -10,17 +10,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/broker-adapter
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -55,17 +47,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/lake-publisher
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -100,17 +84,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/query-api
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -145,17 +121,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/trading-engine
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -190,17 +158,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/dashboard
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -232,17 +192,9 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/superset
       registry: registry.celestium.life
-      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
-      buildkit_config: |
-        [registry."registry.celestium.life"]
-          insecure = true
-        [registry."docker.io"]
-          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
-        [registry."ghcr.io"]
-          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
diff --git a/deploy-docker.sh b/deploy-docker.sh
index fa2a9a0..8ea3751 100755
--- a/deploy-docker.sh
+++ b/deploy-docker.sh
@@ -6,15 +6,18 @@ set -euo pipefail
 # Usage: bash deploy-docker.sh [OPTIONS]
 #
 # Options:
-#   --host USER@HOST       SSH target (default: celes@192.168.42.254)
-#   --ollama-url URL       Ollama API URL (default: auto-detect or install)
-#   --ollama-model MODEL   Ollama model name (default: qwen3.5:9b-fast)
-#   --dir PATH             Remote install directory (default: ~/stonks-oracle)
+#   --host USER@HOST              SSH target (default: celes@192.168.42.254)
+#   --ollama-model MODEL          Ollama model name (default: qwen3.5:9b-fast)
+#   --external-ollama=URL         Use an external Ollama instance instead of deploying one
+#   --dir PATH                    Remote install directory (default: ~/stonks-oracle)
+#   --uninstall                   Tear down the deployment and remove containers/volumes
+#   --help                        Show this help message
 #
 # Examples:
 #   bash deploy-docker.sh
-#   bash deploy-docker.sh --ollama-url http://10.1.1.12:2701 --ollama-model qwen3.6
+#   bash deploy-docker.sh --external-ollama=http://127.0.0.1:11434/
 #   bash deploy-docker.sh --host user@myserver --dir /opt/stonks
+#   bash deploy-docker.sh --uninstall
 
 # -------------------------------------------------------
 # Configuration (override via flags or environment)
@@ -24,22 +27,56 @@ REMOTE_DIR="${DEPLOY_DIR:-/home/celes/stonks-oracle}"
 OLLAMA_URL="${DEPLOY_OLLAMA_URL:-}"
 OLLAMA_MODEL="${DEPLOY_OLLAMA_MODEL:-qwen3.5:9b-fast}"
 REPO_URL="http://admin:St0nks0racl3!@10.1.1.12:30300/admin/stonks-oracle.git"
+DO_UNINSTALL=false
 
 # Parse command-line flags
 while [[ $# -gt 0 ]]; do
   case $1 in
+    --help)
+      sed -n '3,/^$/p' "$0" | sed 's/^# //;s/^#//'
+      exit 0 ;;
     --host) REMOTE_HOST="$2"; shift 2 ;;
-    --ollama-url) OLLAMA_URL="$2"; shift 2 ;;
+    --external-ollama=*) OLLAMA_URL="${1#*=}"; shift ;;
+    --external-ollama) OLLAMA_URL="$2"; shift 2 ;;
     --ollama-model) OLLAMA_MODEL="$2"; shift 2 ;;
     --dir) REMOTE_DIR="$2"; shift 2 ;;
+    --uninstall) DO_UNINSTALL=true; shift ;;
     *) echo "Unknown option: $1"; exit 1 ;;
   esac
 done
 
+# -------------------------------------------------------
+# Uninstall mode
+# -------------------------------------------------------
+if [ "$DO_UNINSTALL" = "true" ]; then
+  echo "=== Stonks Oracle — Uninstall ==="
+  echo "  Target: ${REMOTE_HOST}:${REMOTE_DIR}"
+  echo ""
+  ssh "$REMOTE_HOST" bash -s -- "$REMOTE_DIR" <<'REMOTE_SCRIPT'
+set -euo pipefail
+REMOTE_DIR="$1"
+if [ ! -d "$REMOTE_DIR" ]; then
+  echo "  Nothing to uninstall — $REMOTE_DIR does not exist"
+  exit 0
+fi
+cd "$REMOTE_DIR"
+echo "  Stopping and removing containers, networks, and volumes..."
+docker compose down -v 2>/dev/null || true
+echo "  Removing project directory..."
+rm -rf "$REMOTE_DIR"
+echo "  ✓ Uninstall complete"
+REMOTE_SCRIPT
+  exit 0
+fi
+
 echo "=== Stonks Oracle Docker Deployment ==="
 echo "  Target: ${REMOTE_HOST}:${REMOTE_DIR}"
 echo "  Model:  ${OLLAMA_MODEL}"
-echo "  Ollama: Docker container (GPU-accelerated)"
+if [ -n "$OLLAMA_URL" ] && [ "$OLLAMA_URL" != "http://ollama:11434" ]; then
+  echo "  Ollama: External (${OLLAMA_URL})"
+else
+  echo "  Ollama: Docker container (GPU-accelerated)"
+fi
 echo ""
 
 # -------------------------------------------------------
@@ -285,12 +322,15 @@ echo ""
 # Step 2: Detect or configure Ollama
 # -------------------------------------------------------
 echo "--- Step 2: Configuring Ollama ---"
-# Always use the Docker Ollama container with GPU passthrough
-# The ollama/ollama image ships with CUDA runtime built-in
-USE_DOCKER_OLLAMA=true
-OLLAMA_URL="http://ollama:11434"
-echo "  Using Docker Ollama container (GPU-accelerated via NVIDIA passthrough)"
-echo "  Host-accessible at localhost:11434"
+if [ -n "$OLLAMA_URL" ]; then
+  USE_DOCKER_OLLAMA=false
+  echo "  Using external Ollama at ${OLLAMA_URL}"
+else
+  USE_DOCKER_OLLAMA=true
+  OLLAMA_URL="http://ollama:11434"
+  echo "  Using Docker Ollama container (GPU-accelerated via NVIDIA passthrough)"
+  echo "  Host-accessible at localhost:11434"
+fi
 echo ""
 
 # -------------------------------------------------------
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 81e7f5b..94b2039 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,5 +1,5 @@
 # Base image: uses Harbor proxy cache in CI, falls back to Docker Hub externally
-FROM registry.celestium.life/dockerhub-cache/library/python:3.12-slim
+FROM python:3.12-slim
 
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
diff --git a/docker/Dockerfile.scheduler b/docker/Dockerfile.scheduler
index cc3d036..febf21c 100644
--- a/docker/Dockerfile.scheduler
+++ b/docker/Dockerfile.scheduler
@@ -1,6 +1,6 @@
 # Scheduler image — adds postgresql-client for running migrations via psql.
 # Built separately from the base service image. Only the scheduler uses this.
-FROM registry.celestium.life/dockerhub-cache/library/python:3.12-slim
+FROM python:3.12-slim
 
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
diff --git a/docker/Dockerfile.superset b/docker/Dockerfile.superset
index 2d2153b..b711015 100644
--- a/docker/Dockerfile.superset
+++ b/docker/Dockerfile.superset
@@ -1,6 +1,6 @@
 # Custom Superset image with Trino, PostgreSQL, and Redis drivers
 # Base image: uses Harbor proxy cache in CI, falls back to Docker Hub externally
-FROM registry.celestium.life/dockerhub-cache/apache/superset:latest
+FROM apache/superset:latest
 
 USER root
 RUN /app/docker/pip-install.sh --no-cache trino[sqlalchemy] psycopg2-binary redis
diff --git a/infra/migrations/031_fix_agent_defaults.sql b/infra/migrations/031_fix_agent_defaults.sql
index ca8c554..9e13051 100644
--- a/infra/migrations/031_fix_agent_defaults.sql
+++ b/infra/migrations/031_fix_agent_defaults.sql
@@ -1,13 +1,3 @@
--- Fix agent default model_provider and model_name to match production config.
--- The original migration 026 seeded with 'ollama'/'qwen3.5:9b-fast' but production
--- uses vLLM. This migration updates agents that still have the old defaults,
--- preserving any user customizations (only updates if model_name matches the old default).
-
-UPDATE ai_agents
-   SET model_provider = 'vllm',
-       model_name = 'AxionML/Qwen3.5-9B-NVFP4',
-       max_tokens = 2048,
-       updated_at = NOW()
- WHERE slug IN ('document-extractor', 'event-classifier', 'thesis-rewriter')
-   AND source = 'system'
-   AND model_name = 'qwen3.5:9b-fast';
+-- NO-OP: Previously forced vllm model on agents. Model config is now managed
+-- via the OLLAMA_MODEL / VLLM_MODEL env vars and the ai_agents table at runtime.
+-- Do not override model_provider or model_name in migrations.
diff --git a/infra/migrations/033_stop_hardcoding_agent_model.sql b/infra/migrations/033_stop_hardcoding_agent_model.sql
index eee4b52..ffeec01 100644
--- a/infra/migrations/033_stop_hardcoding_agent_model.sql
+++ b/infra/migrations/033_stop_hardcoding_agent_model.sql
@@ -1,16 +1,3 @@
--- Stop hardcoding agent model_name in migrations.
---
--- Migration 029 previously forced model_name='qwen3.5:9b-fast' on every
--- deploy, overwriting per-environment model configuration.  That migration
--- has been fixed to only sync system_prompt (not model_name).
---
--- This migration updates agents still on the old ollama provider/model
--- to use vllm with the default VLLM model.  Agents already configured
--- with a different model (e.g. via the API) are left untouched.
-
-UPDATE ai_agents
-SET model_provider = 'vllm',
-    model_name     = 'AxionML/Qwen3.5-9B-NVFP4',
-    updated_at     = NOW()
-WHERE model_name IN ('qwen3.5:9b-fast', 'qwen3.5:9b')
-  AND source = 'system';
+-- NO-OP: Previously forced vllm model on agents. Model config is now managed
+-- via the ai_agents table at runtime. Do not override model_provider or
+-- model_name in migrations.