diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index a6c8822..f8b7e45 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -1,5 +1,5 @@
 # Build the Crucible image. PR-first (D7): PRs build only; push to main also
-# publishes registry.westgate.pw/sow/crucible:<git-sha>. Never a mutable tag.
+# publishes registry.westgate.pw/deployment/crucible:<git-sha>. Never a mutable tag.
 #
 # Daemonless: the host-mode runner has no container runtime, so the image is
 # built by Nix (`nix build .#image`, see flake.nix) and pushed with skopeo
@@ -13,7 +13,7 @@ on:
 
 env:
   REGISTRY: registry.westgate.pw
-  IMAGE: sow/crucible
+  IMAGE: deployment/crucible
 
 jobs:
   build-image:
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index bf558e8..e7caf19 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -10,7 +10,7 @@ on:
 
 env:
   REGISTRY: registry.westgate.pw
-  IMAGE: sow/crucible
+  IMAGE: deployment/crucible
 
 jobs:
   release:
@@ -34,5 +34,5 @@ jobs:
           name: crucible-${{ github.ref_name }}
           path: dist/*
 
-      # TODO(phase-6): re-tag registry.westgate.pw/sow/crucible:<sha> as :<tag>
+      # TODO(phase-6): re-tag registry.westgate.pw/deployment/crucible:<sha> as :<tag>
       # and pin it from sow-platform releases/*.yml once the registry is live.
diff --git a/README.md b/README.md
index d80b35f..9ab27ee 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ This retires the old habit of checking in `nwn-tool` / `sow-toolkit`.
 PR-first (D7): every check runs on pull requests and on push to `main`.
 
 - `test.yml` — vet, test, shellcheck, yamllint, binary smoke.
-- `build-image.yml` — build `registry.westgate.pw/sow/crucible:<sha>`; publish
+- `build-image.yml` — build `registry.westgate.pw/deployment/crucible:<sha>`; publish
   only on `main`. PRs build but never push. No mutable tags.
 - `release.yml` — tag-gated binary bundles; image re-tag is wired in Phase 6.
 
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 27472cc..7d1930e 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 #
-# Crucible toolchain image: registry.westgate.pw/sow/crucible:<git-sha>
+# Crucible toolchain image: registry.westgate.pw/deployment/crucible:<git-sha>
 #
 # Reproducible multi-stage build, no on-VPS build. Produces every cmd/* binary
 # and ships them on a static base. The `crucible` dispatcher is the entrypoint;
diff --git a/docs/consumer-contract.md b/docs/consumer-contract.md
index 8d06ae3..75bc224 100644
--- a/docs/consumer-contract.md
+++ b/docs/consumer-contract.md
@@ -28,7 +28,7 @@ Run the consumer job inside the pinned image and the binaries are on `PATH`:
 
 ```yaml
 container:
-  image: registry.westgate.pw/sow/crucible:<sha>   # pinned, immutable
+  image: registry.westgate.pw/deployment/crucible:<sha>   # pinned, immutable
 ```
 
 No host install, no `$HOME` layout, no developer machine assumptions.
diff --git a/flake.nix b/flake.nix
index 1ac7007..72605d8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -47,7 +47,7 @@
           default = crucible;
 
           image = pkgs.dockerTools.buildLayeredImage {
-            name = "registry.westgate.pw/sow/crucible";
+            name = "registry.westgate.pw/deployment/crucible";
             tag = version;
             contents = [ crucible pkgs.cacert pkgs.ffmpeg-headless pkgs.fakeNss ];
             config = {