diff --git a/.woodpecker/build-1.yml b/.woodpecker/build-1.yml
index 6a1b4bc..176f9ae 100644
--- a/.woodpecker/build-1.yml
+++ b/.woodpecker/build-1.yml
@@ -10,9 +10,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/scheduler
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -43,9 +51,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/symbol-registry
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -80,9 +96,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/ingestion
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -117,9 +141,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/parser
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
diff --git a/.woodpecker/build-2.yml b/.woodpecker/build-2.yml
index 3f19aa4..47f5b76 100644
--- a/.woodpecker/build-2.yml
+++ b/.woodpecker/build-2.yml
@@ -10,9 +10,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/extractor
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -47,9 +55,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/aggregation
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -84,9 +100,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/recommendation
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -121,9 +145,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/signal-engine
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -158,9 +190,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/risk
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
diff --git a/.woodpecker/build-3.yml b/.woodpecker/build-3.yml
index da629bd..c223178 100644
--- a/.woodpecker/build-3.yml
+++ b/.woodpecker/build-3.yml
@@ -10,9 +10,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/broker-adapter
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -47,9 +55,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/lake-publisher
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -84,9 +100,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/query-api
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -121,9 +145,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/trading-engine
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -158,9 +190,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/dashboard
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
@@ -192,9 +232,17 @@ steps:
     settings:
       repo: registry.celestium.life/stonks-oracle/superset
       registry: registry.celestium.life
+      buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
       insecure: true
+      buildkit_config: |
+        [registry."registry.celestium.life"]
+          insecure = true
+        [registry."docker.io"]
+          mirrors = ["registry.celestium.life/v2/dockerhub-cache"]
+        [registry."ghcr.io"]
+          mirrors = ["registry.celestium.life/v2/ghcr-cache"]
       http_proxy: ""
       https_proxy: ""
       no_proxy: ""
diff --git a/.woodpecker/finalize.yml b/.woodpecker/finalize.yml
index 91ead9d..afd8f26 100644
--- a/.woodpecker/finalize.yml
+++ b/.woodpecker/finalize.yml
@@ -10,7 +10,7 @@ when:
 
 steps:
   integration-test:
-    image: alpine/k8s:1.30.2
+    image: registry.celestium.life/dockerhub-cache/alpine/k8s:1.30.2
     environment:
       DOCKERHUB_USER:
         from_secret: docker_username
@@ -29,7 +29,7 @@ steps:
             cpu: 1000m
 
   mirror-github:
-    image: alpine/git
+    image: registry.celestium.life/dockerhub-cache/alpine/git
     failure: ignore
     environment:
       GITHUB_SSH_KEY:
diff --git a/.woodpecker/test.yml b/.woodpecker/test.yml
index 81e9b85..66f6ecd 100644
--- a/.woodpecker/test.yml
+++ b/.woodpecker/test.yml
@@ -4,7 +4,7 @@ when:
   - pull_request
 steps:
   lint-python:
-    image: python:3.12-slim
+    image: registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     commands:
     - pip install ruff==0.15.10 --quiet
     - ruff --version
@@ -20,7 +20,7 @@ steps:
             cpu: 1000m
     depends_on: []
   test-python:
-    image: python:3.12-slim
+    image: registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     commands:
     - pip install -r requirements.txt --quiet
     - pip install hypothesis --quiet
@@ -36,7 +36,7 @@ steps:
             cpu: 2000m
     depends_on: []
   test-frontend:
-    image: node:24-slim
+    image: registry.celestium.life/dockerhub-cache/library/node:24-slim
     commands:
     - cd frontend
     - npm ci
diff --git a/deploy-docker.sh b/deploy-docker.sh
index 8ea3751..fa2a9a0 100755
--- a/deploy-docker.sh
+++ b/deploy-docker.sh
@@ -6,18 +6,15 @@ set -euo pipefail
 # Usage: bash deploy-docker.sh [OPTIONS]
 #
 # Options:
-#   --host USER@HOST              SSH target (default: celes@192.168.42.254)
-#   --ollama-model MODEL          Ollama model name (default: qwen3.5:9b-fast)
-#   --external-ollama=URL         Use an external Ollama instance instead of deploying one
-#   --dir PATH                    Remote install directory (default: ~/stonks-oracle)
-#   --uninstall                   Tear down the deployment and remove containers/volumes
-#   --help                        Show this help message
+#   --host USER@HOST       SSH target (default: celes@192.168.42.254)
+#   --ollama-url URL       Ollama API URL (default: auto-detect or install)
+#   --ollama-model MODEL   Ollama model name (default: qwen3.5:9b-fast)
+#   --dir PATH             Remote install directory (default: ~/stonks-oracle)
 #
 # Examples:
 #   bash deploy-docker.sh
-#   bash deploy-docker.sh --external-ollama=http://127.0.0.1:11434/
+#   bash deploy-docker.sh --ollama-url http://10.1.1.12:2701 --ollama-model qwen3.6
 #   bash deploy-docker.sh --host user@myserver --dir /opt/stonks
-#   bash deploy-docker.sh --uninstall
 
 # -------------------------------------------------------
 # Configuration (override via flags or environment)
@@ -27,56 +24,22 @@ REMOTE_DIR="${DEPLOY_DIR:-/home/celes/stonks-oracle}"
 OLLAMA_URL="${DEPLOY_OLLAMA_URL:-}"
 OLLAMA_MODEL="${DEPLOY_OLLAMA_MODEL:-qwen3.5:9b-fast}"
 REPO_URL="http://admin:St0nks0racl3!@10.1.1.12:30300/admin/stonks-oracle.git"
-DO_UNINSTALL=false
 
 # Parse command-line flags
 while [[ $# -gt 0 ]]; do
   case $1 in
-    --help)
-      sed -n '3,/^$/p' "$0" | sed 's/^# //;s/^#//'
-      exit 0 ;;
     --host) REMOTE_HOST="$2"; shift 2 ;;
-    --external-ollama=*) OLLAMA_URL="${1#*=}"; shift ;;
-    --external-ollama) OLLAMA_URL="$2"; shift 2 ;;
+    --ollama-url) OLLAMA_URL="$2"; shift 2 ;;
     --ollama-model) OLLAMA_MODEL="$2"; shift 2 ;;
     --dir) REMOTE_DIR="$2"; shift 2 ;;
-    --uninstall) DO_UNINSTALL=true; shift ;;
     *) echo "Unknown option: $1"; exit 1 ;;
   esac
 done
 
-# -------------------------------------------------------
-# Uninstall mode
-# -------------------------------------------------------
-if [ "$DO_UNINSTALL" = "true" ]; then
-  echo "=== Stonks Oracle — Uninstall ==="
-  echo "  Target: ${REMOTE_HOST}:${REMOTE_DIR}"
-  echo ""
-  ssh "$REMOTE_HOST" bash -s -- "$REMOTE_DIR" <<'REMOTE_SCRIPT'
-set -euo pipefail
-REMOTE_DIR="$1"
-if [ ! -d "$REMOTE_DIR" ]; then
-  echo "  Nothing to uninstall — $REMOTE_DIR does not exist"
-  exit 0
-fi
-cd "$REMOTE_DIR"
-echo "  Stopping and removing containers, networks, and volumes..."
-docker compose down -v 2>/dev/null || true
-echo "  Removing project directory..."
-rm -rf "$REMOTE_DIR"
-echo "  ✓ Uninstall complete"
-REMOTE_SCRIPT
-  exit 0
-fi
-
 echo "=== Stonks Oracle Docker Deployment ==="
 echo "  Target: ${REMOTE_HOST}:${REMOTE_DIR}"
 echo "  Model:  ${OLLAMA_MODEL}"
-if [ -n "$OLLAMA_URL" ] && [ "$OLLAMA_URL" != "http://ollama:11434" ]; then
-  echo "  Ollama: External (${OLLAMA_URL})"
-else
-  echo "  Ollama: Docker container (GPU-accelerated)"
-fi
+echo "  Ollama: Docker container (GPU-accelerated)"
 echo ""
 
 # -------------------------------------------------------
@@ -322,15 +285,12 @@ echo ""
 # Step 2: Detect or configure Ollama
 # -------------------------------------------------------
 echo "--- Step 2: Configuring Ollama ---"
-if [ -n "$OLLAMA_URL" ]; then
-  USE_DOCKER_OLLAMA=false
-  echo "  Using external Ollama at ${OLLAMA_URL}"
-else
-  USE_DOCKER_OLLAMA=true
-  OLLAMA_URL="http://ollama:11434"
-  echo "  Using Docker Ollama container (GPU-accelerated via NVIDIA passthrough)"
-  echo "  Host-accessible at localhost:11434"
-fi
+# Always use the Docker Ollama container with GPU passthrough
+# The ollama/ollama image ships with CUDA runtime built-in
+USE_DOCKER_OLLAMA=true
+OLLAMA_URL="http://ollama:11434"
+echo "  Using Docker Ollama container (GPU-accelerated via NVIDIA passthrough)"
+echo "  Host-accessible at localhost:11434"
 echo ""
 
 # -------------------------------------------------------
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 94b2039..81e7f5b 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,5 +1,5 @@
 # Base image: uses Harbor proxy cache in CI, falls back to Docker Hub externally
-FROM python:3.12-slim
+FROM registry.celestium.life/dockerhub-cache/library/python:3.12-slim
 
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
diff --git a/docker/Dockerfile.scheduler b/docker/Dockerfile.scheduler
index febf21c..cc3d036 100644
--- a/docker/Dockerfile.scheduler
+++ b/docker/Dockerfile.scheduler
@@ -1,6 +1,6 @@
 # Scheduler image — adds postgresql-client for running migrations via psql.
 # Built separately from the base service image. Only the scheduler uses this.
-FROM python:3.12-slim
+FROM registry.celestium.life/dockerhub-cache/library/python:3.12-slim
 
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
diff --git a/docker/Dockerfile.superset b/docker/Dockerfile.superset
index b711015..2d2153b 100644
--- a/docker/Dockerfile.superset
+++ b/docker/Dockerfile.superset
@@ -1,6 +1,6 @@
 # Custom Superset image with Trino, PostgreSQL, and Redis drivers
 # Base image: uses Harbor proxy cache in CI, falls back to Docker Hub externally
-FROM apache/superset:latest
+FROM registry.celestium.life/dockerhub-cache/apache/superset:latest
 
 USER root
 RUN /app/docker/pip-install.sh --no-cache trino[sqlalchemy] psycopg2-binary redis
diff --git a/infra/migrations/031_fix_agent_defaults.sql b/infra/migrations/031_fix_agent_defaults.sql
index 9e13051..ca8c554 100644
--- a/infra/migrations/031_fix_agent_defaults.sql
+++ b/infra/migrations/031_fix_agent_defaults.sql
@@ -1,3 +1,13 @@
--- NO-OP: Previously forced vllm model on agents. Model config is now managed
--- via the OLLAMA_MODEL / VLLM_MODEL env vars and the ai_agents table at runtime.
--- Do not override model_provider or model_name in migrations.
+-- Fix agent default model_provider and model_name to match production config.
+-- The original migration 026 seeded with 'ollama'/'qwen3.5:9b-fast' but production
+-- uses vLLM. This migration updates agents that still have the old defaults,
+-- preserving any user customizations (only updates if model_name matches the old default).
+
+UPDATE ai_agents
+   SET model_provider = 'vllm',
+       model_name = 'AxionML/Qwen3.5-9B-NVFP4',
+       max_tokens = 2048,
+       updated_at = NOW()
+ WHERE slug IN ('document-extractor', 'event-classifier', 'thesis-rewriter')
+   AND source = 'system'
+   AND model_name = 'qwen3.5:9b-fast';
diff --git a/infra/migrations/033_stop_hardcoding_agent_model.sql b/infra/migrations/033_stop_hardcoding_agent_model.sql
index ffeec01..eee4b52 100644
--- a/infra/migrations/033_stop_hardcoding_agent_model.sql
+++ b/infra/migrations/033_stop_hardcoding_agent_model.sql
@@ -1,3 +1,16 @@
--- NO-OP: Previously forced vllm model on agents. Model config is now managed
--- via the ai_agents table at runtime. Do not override model_provider or
--- model_name in migrations.
+-- Stop hardcoding agent model_name in migrations.
+--
+-- Migration 029 previously forced model_name='qwen3.5:9b-fast' on every
+-- deploy, overwriting per-environment model configuration.  That migration
+-- has been fixed to only sync system_prompt (not model_name).
+--
+-- This migration updates agents still on the old ollama provider/model
+-- to use vllm with the default VLLM model.  Agents already configured
+-- with a different model (e.g. via the API) are left untouched.
+
+UPDATE ai_agents
+SET model_provider = 'vllm',
+    model_name     = 'AxionML/Qwen3.5-9B-NVFP4',
+    updated_at     = NOW()
+WHERE model_name IN ('qwen3.5:9b-fast', 'qwen3.5:9b')
+  AND source = 'system';