diff --git a/.gitea/workflows/publish-songs.yml b/.gitea/workflows/publish-songs.yml
index b0f145c..d1ffebc 100644
--- a/.gitea/workflows/publish-songs.yml
+++ b/.gitea/workflows/publish-songs.yml
@@ -19,14 +19,9 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     container:
-      image: python:3.12-slim
+      image: novoyuuparosk-wiki-runner:latest
 
     steps:
-      - name: Install system deps
-        run: |
-          apt-get update -qq
-          apt-get install -y --no-install-recommends git pandoc ca-certificates
-
       - name: Checkout ncmr-songs
         env:
           FAPAT: ${{ secrets.FAPAT }}
@@ -41,9 +36,6 @@ jobs:
           URL_TO_GITEA: ${{ vars.URL_TO_GITEA }}
         run: git clone "http://mikkeli:${FAPAT}@${URL_TO_GITEA#http://}/mikkeli/novoyuuparosk-auto-wiki" auto-wiki
 
-      - name: Install Python deps
-        run: pip install --no-cache-dir -r auto-wiki/pipelines/songs/requirements.txt
-
       - name: Detect changed files
         id: diff
         run: |
diff --git a/README.md b/README.md
index 20e42a0..7e0d136 100644
--- a/README.md
+++ b/README.md
@@ -16,10 +16,10 @@ Hybrid layout. The Gitea Actions trigger must live in the source repo (Gitea onl
 
 ```
 <source-repo>/
-  .gitea/workflows/<name>.yml       <- workflow: installs deps, clones this repo, runs renderer
+  .gitea/workflows/<name>.yml       <- workflow: clones this repo, runs renderer (deps pre-baked in job image)
 
 novoyuuparosk-auto-wiki/             <- this repo
-  .gitea/workflows/<pipeline>.yml    <- reusable workflow stubs (kept for reference; not actively called)
+  .gitea/workflows/<pipeline>.yml    <- reusable workflow stubs (kept for reference; not actively called; may be stale)
   pipelines/<pipeline>/              <- per-pipeline code, schema, templates
   lib/                               <- shared modules (MediaWiki client, etc.)
 ```
@@ -33,12 +33,9 @@ Note: `workflow_call` across private repos was abandoned — the auto-generated
 
 ## Bot identity
 
-MediaWiki BotPassword issued for user `Dubrowski`, bot name `giteaAutomaton`.
+MediaWiki BotPassword issued for user `Dubrowski`, bot name `giteaAutomaton`. Login form: `Dubrowski@giteaAutomaton`.
 
-Login as `Dubrowski@giteaAutomaton` with password `d8jua48t65jgjp3dfcqhfg7257tri6ui`.
-(Legacy form: username `Dubrowski`, password `giteaAutomaton@d8jua48t65jgjp3dfcqhfg7257tri6ui`.)
-
-Plaintext here is acceptable for the current phase (private repo, home-Pi LAN-only Gitea). Rotate before any of those preconditions change. Note that `git log` retains this string forever, so rotation requires a wiki-side BotPassword regeneration regardless of what happens to this file.
+Credentials are stored in the Gitea user-scope secret vault under `mikkeli` (`WIKI_BOT_USER`, `WIKI_BOT_PASSWORD`). Not stored in this repo.
 
 ## Runner infrastructure
 
diff --git a/pipelines/songs/README.md b/pipelines/songs/README.md
index 610d83e..e1fbdcc 100644
--- a/pipelines/songs/README.md
+++ b/pipelines/songs/README.md
@@ -59,9 +59,9 @@ Triggers:
 
 ## Dependencies
 
-- Python 3.12+ (job container: `python:3.12-slim`)
-- Pandoc (apt-installed in the job container)
-- `python-frontmatter`, `mwclient`, `PyYAML` — see `requirements.txt`
+Job container: `novoyuuparosk-wiki-runner:latest` (pre-built, stored in the local Docker daemon on the runner host). Bakes in Python 3.12, Pandoc, and all pipeline Python packages — no install steps at job runtime.
+
+See the `Dockerfile` at the repo root and `requirements.txt` in this directory. Rebuild the image after changes to either.
 
 ## Modes