diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 6462d49..ba702c5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,7 +2,8 @@
 # Ordinis — build & push images.
 # Runner mirror'ит Docker Hub (DOCKER_AUTH_CONFIG в runner config),
 # поэтому image: repo.nstart.cloud/library/maven:... работает напрямую.
-# Internal registry registry.k8s.265.nstart.local — без auth.
+# Все образы пушатся в repo.nstart.cloud/terravault/ — единый registry
+# для всех кластеров (staging 161, prod 142, локальный dev).
 # =============================================================
 
 stages:
@@ -15,8 +16,7 @@ variables:
   MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
   MAVEN_CLI_OPTS: "-B -ntp --batch-mode"
   IMAGE_TAG: $CI_COMMIT_REF_SLUG-$CI_COMMIT_SHORT_SHA
-  INTERNAL_REGISTRY: registry.k8s.265.nstart.local
-  EXTERNAL_REGISTRY: repo.nstart.cloud
+  REGISTRY: repo.nstart.cloud
   IMAGE_REPO: terravault
   DOCKER_BUILDKIT: "1"
 
@@ -66,28 +66,25 @@ maven-package:
   services:
     - name: repo.nstart.cloud/library/docker:26-dind
       alias: docker
-      command: ["--tls=false", "--insecure-registry=registry.k8s.265.nstart.local"]
+      command: ["--tls=false"]
   variables:
     DOCKER_HOST: tcp://docker:2375
     DOCKER_TLS_CERTDIR: ""
     DOCKER_BUILDKIT: "1"
-  before_script:
-    - echo "$REGISTRY_PASSWORD" | docker login "$EXTERNAL_REGISTRY" -u "$REGISTRY_USER" --password-stdin
 
-# Helper для dual-push: build один раз с двумя registry-тэгами, push в оба.
-# Internal registry — без auth (insecure), external — с docker login (см. before_script).
-.dual_push_script: &dual_push_script |
-  IMG_INT="$INTERNAL_REGISTRY/$IMAGE_REPO/$SVC"
-  IMG_EXT="$EXTERNAL_REGISTRY/$IMAGE_REPO/$SVC"
+# Build & push в repo.nstart.cloud (corp Harbor) — единый registry для всех окружений.
+# DinD должен быть готов когда запускается script. Wait-loop защищает от race.
+.publish_script: &publish_script |
+  for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 1; done
+  echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+  IMG="$REGISTRY/$IMAGE_REPO/$SVC"
   docker build -f "$DOCKERFILE" \
-    -t "$IMG_INT:$IMAGE_TAG" -t "$IMG_INT:latest" -t "$IMG_INT:$CI_COMMIT_REF_SLUG" \
-    -t "$IMG_EXT:$IMAGE_TAG" -t "$IMG_EXT:latest" -t "$IMG_EXT:$CI_COMMIT_REF_SLUG" \
+    -t "$IMG:$IMAGE_TAG" -t "$IMG:latest" -t "$IMG:$CI_COMMIT_REF_SLUG" \
     --build-arg BUILDKIT_INLINE_CACHE=1 \
     "$BUILD_CONTEXT"
-  for TAG in "$IMAGE_TAG" latest "$CI_COMMIT_REF_SLUG"; do
-    docker push "$IMG_INT:$TAG"
-    docker push "$IMG_EXT:$TAG"
-  done
+  docker push "$IMG:$IMAGE_TAG"
+  docker push "$IMG:latest"
+  docker push "$IMG:$CI_COMMIT_REF_SLUG"
 
 docker-app:
   <<: *docker_base
@@ -97,7 +94,7 @@ docker-app:
     DOCKERFILE: ordinis-app/Dockerfile
     BUILD_CONTEXT: .
   script:
-    - *dual_push_script
+    - *publish_script
 
 docker-read-api:
   <<: *docker_base
@@ -107,7 +104,7 @@ docker-read-api:
     DOCKERFILE: ordinis-read-api/Dockerfile
     BUILD_CONTEXT: .
   script:
-    - *dual_push_script
+    - *publish_script
 
 docker-projection-writer:
   <<: *docker_base
@@ -117,7 +114,7 @@ docker-projection-writer:
     DOCKERFILE: ordinis-projection-writer/Dockerfile
     BUILD_CONTEXT: .
   script:
-    - *dual_push_script
+    - *publish_script
 
 docker-migrations:
   <<: *docker_base
@@ -127,7 +124,7 @@ docker-migrations:
     DOCKERFILE: ordinis-migrations/Dockerfile
     BUILD_CONTEXT: ordinis-migrations/
   script:
-    - *dual_push_script
+    - *publish_script
 
 # ─── TRIGGER DEPLOY (downstream pipeline) ──────
 trigger-deploy-staging: