diff --git a/README.md b/README.md
index 07bc0bb..9dd8316 100644
--- a/README.md
+++ b/README.md
@@ -46,7 +46,7 @@ in after checkout; repo-committed values win over the Jenkinsfile call).
 |---|---|---|
 | `service_name` | `repo_name` | Second path segment under `devops-helm-charts/values/` |
 | `argo_app_name` | `repo_name` | Must match the ArgoCD Application's `metadata.name` |
-| `harbor_project` | `homelab` | Must be an existing, public Harbor project |
+| `harbor_project` | `apps-registry` | Must already exist in Harbor, and be public unless you also wire an `imagePullSecret` — the app values assume anonymous pull. A push to a missing project fails as `unauthorized: project <name> not found` |
 | `helm_repo_url` | `devops-helm-charts-gcp`, over cluster DNS | `http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/…` — pod-to-pod, so it never leaves the cluster and comes back through the ingress |
 | `image_tag_yq_path` | `.deployment.image.tag` | **Override this if the app's chart isn't `1.0.0`** — e.g. `sts-2.0.0` uses `.podtemplate.image.tag` instead. Getting this wrong doesn't fail loudly: `yq -i` creates the path if missing rather than erroring, silently leaving the real field un-bumped. |
 | `dockerBuildVersion` | none | Only read when the repo has **no Dockerfile of its own** — picks a fallback template (see below). No default; either ship a Dockerfile or set this. |
diff --git a/vars/homelabPipeline.groovy b/vars/homelabPipeline.groovy
index d72c8d3..84f553b 100644
--- a/vars/homelabPipeline.groovy
+++ b/vars/homelabPipeline.groovy
@@ -23,7 +23,12 @@
 def call(Map config) {
     config.service_name      = config.service_name      ?: config.repo_name
     config.argo_app_name     = config.argo_app_name      ?: config.repo_name
-    config.harbor_project    = config.harbor_project     ?: 'homelab'
+    // The Harbor project images are pushed to. Named apps-registry on this
+    // cluster, not the homelab's "homelab" — the project has to already
+    // exist, and Harbor rejects a push to a missing one with
+    // "unauthorized: project <name> not found", which reads like a
+    // credentials problem rather than a missing project.
+    config.harbor_project    = config.harbor_project     ?: 'apps-registry'
     // Cluster DNS, not the ingress hostname: this clone happens from a build
     // pod, so it is pod-to-pod traffic and has no business leaving the
     // cluster and coming back in through Contour.