diff --git a/platform/staging/forgejo.yaml b/platform/staging/forgejo.yaml
index d7953af..9be5628 100644
--- a/platform/staging/forgejo.yaml
+++ b/platform/staging/forgejo.yaml
@@ -51,8 +51,8 @@ spec:
           OPENID_CONNECT_SCOPES: "email profile"
           USERNAME: username
         service:
-          ENABLE_INTERNAL_SIGNIN: false
-          ALLOW_ONLY_EXTERNAL_REGISTRATION: true
+          ENABLE_INTERNAL_SIGNIN: true
+          DISABLE_REGISTRATION: true
         "service.explore":
           DISABLE_USERS_PAGE: true
         actions:
@@ -63,12 +63,13 @@ spec:
           SHOW_FOOTER_VERSION: false
           SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
           SHOW_FOOTER_POWERED_BY: false
-      oauth:
-        - name: SSO
-          provider: 'openidConnect'
-          autoDiscoverUrl: https://dex.cloudlab.khuedoan.com/.well-known/openid-configuration
-          key: vault:secret/data/forgejo/oauth#key
-          secret: vault:secret/data/forgejo/oauth#secret
+      # Staging does not currently run Dex, so keep Forgejo self-contained.
+      # oauth:
+      #   - name: SSO
+      #     provider: 'openidConnect'
+      #     autoDiscoverUrl: https://dex.cloudlab.khuedoan.com/.well-known/openid-configuration
+      #     key: vault:secret/data/forgejo/oauth#key
+      #     secret: vault:secret/data/forgejo/oauth#secret
       admin:
         email: admin@cloudlab.khuedoan.com
         username: forgejo_admin
diff --git a/platform/staging/vault.yaml b/platform/staging/vault.yaml
index 7004a02..17d6ffc 100644
--- a/platform/staging/vault.yaml
+++ b/platform/staging/vault.yaml
@@ -97,6 +97,11 @@ spec:
                   policies:
                   - allow_secrets
                   ttl: 1h
+                config:
+                  # Needs to be explicit, otherwise it will fallback to
+                  # https://$KUBERNETES_SERVICE_HOST & breaks on IPv6-only
+                  # cluster because the address is not bracketed
+                  kubernetes_host: https://kubernetes.default.svc.cluster.local:443
                 type: kubernetes
               policies:
               - name: allow_secrets