diff --git a/deploy/deployment.yaml b/deploy/deployment.yaml
deleted file mode 100644
index 7bc3d63..0000000
--- a/deploy/deployment.yaml
+++ /dev/null
@@ -1,71 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tack
-  namespace: tack
-spec:
-  replicas: 1  # SQLite is single-writer; do not scale above 1
-  selector:
-    matchLabels:
-      app: tack
-  template:
-    metadata:
-      labels:
-        app: tack
-    spec:
-      serviceAccountName: tack
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: tack
-          image: atcr.io/dsx.sh/tack:latest
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8080
-          env:
-            - name: TACK_LISTEN_ADDR
-              value: ":8080"
-            - name: TACK_DB_PATH
-              value: "/var/lib/tack/tack.db"
-            - name: TACK_TEKTON_ENABLED
-              value: "1"
-            - name: TACK_TEKTON_NAMESPACE
-              value: "tekton-pipelines"
-          envFrom:
-            - secretRef:
-                name: tack
-          volumeMounts:
-            - name: db
-              mountPath: /var/lib/tack
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 2
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              memory: 256Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-      volumes:
-        - name: db
-          persistentVolumeClaim:
-            claimName: tack-db
diff --git a/deploy/hello-world.yaml b/deploy/hello-world.yaml
deleted file mode 100644
index b26f107..0000000
--- a/deploy/hello-world.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Pipeline
-metadata:
-  name: hello-world
-spec:
-  description: Simple Pipeline for validating Tack-created Tekton PipelineRuns.
-  params:
-    - name: message
-      type: string
-      default: Hello from Tack
-    - name: name
-      type: string
-      default: world
-  tasks:
-    - name: say-hello
-      taskRef:
-        name: hello-world
-      params:
-        - name: message
-          value: $(params.message)
-        - name: name
-          value: $(params.name)
-    - name: finish
-      runAfter:
-        - say-hello
-      taskRef:
-        name: hello-world-finish
-      params:
-        - name: name
-          value: $(params.name)
----
-apiVersion: tekton.dev/v1
-kind: Pipeline
-metadata:
-  name: hello-world-inline
-spec:
-  description: Single inline-task Pipeline for the smallest Tack smoke test.
-  params:
-    - name: message
-      type: string
-      default: Hello from Tack
-  tasks:
-    - name: say-hello
-      taskSpec:
-        params:
-          - name: message
-            type: string
-        steps:
-          - name: hello
-            image: busybox:1.36
-            script: |
-              #!/bin/sh
-              set -eu
-              echo "$(params.message)"
-      params:
-        - name: message
-          value: $(params.message)
diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml
deleted file mode 100644
index 3fb2164..0000000
--- a/deploy/kustomization.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: tack
-resources:
-  - namespace.yaml
-  - serviceaccount.yaml
-  - rbac.yaml
-  - pvc.yaml
-  - secret.yaml
-  - deployment.yaml
-  - service.yaml
diff --git a/deploy/namespace.yaml b/deploy/namespace.yaml
deleted file mode 100644
index 7938dfc..0000000
--- a/deploy/namespace.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tack
-  labels:
-    atcr.io-image: "true"
diff --git a/deploy/pvc.yaml b/deploy/pvc.yaml
deleted file mode 100644
index 10d6c59..0000000
--- a/deploy/pvc.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: tack-db
-  namespace: tack
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
diff --git a/deploy/rbac.yaml b/deploy/rbac.yaml
deleted file mode 100644
index d68da8e..0000000
--- a/deploy/rbac.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-# Role in tekton-pipelines so tack can manage PipelineRuns and read pod logs there.
-# The RoleBinding references tack's ServiceAccount cross-namespace.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: tack
-  namespace: tekton-pipelines
-rules:
-  - apiGroups: ["tekton.dev"]
-    resources: ["pipelineruns"]
-    verbs: ["create", "get", "list", "watch"]
-  - apiGroups: ["tekton.dev"]
-    resources: ["taskruns"]
-    verbs: ["list"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["pods/log"]
-    verbs: ["get"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: tack
-  namespace: tekton-pipelines
-subjects:
-  - kind: ServiceAccount
-    name: tack
-    namespace: tack
-roleRef:
-  kind: Role
-  name: tack
-  apiGroup: rbac.authorization.k8s.io
diff --git a/deploy/secret.yaml b/deploy/secret.yaml
deleted file mode 100644
index 3fff4c5..0000000
--- a/deploy/secret.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-# Rename to secret.yaml and fill in real values before applying.
-# Do not commit populated secrets to version control.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: tack
-  namespace: tack
-type: Opaque
-stringData:
-  TACK_HOSTNAME: "tack.example.com"
-  TACK_OWNER_DID: "did:plc:1234"
-  # Uncomment to enable Buildkite provider:
-  # TACK_BUILDKITE_TOKEN: ""
-  # TACK_BUILDKITE_ORG: ""
-  # TACK_BUILDKITE_WEBHOOK_SECRET: ""
diff --git a/deploy/service.yaml b/deploy/service.yaml
deleted file mode 100644
index 3e4bfe3..0000000
--- a/deploy/service.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: tack
-  namespace: tack
-spec:
-  selector:
-    app: tack
-  ports:
-    - name: http
-      port: 80
-      targetPort: http
diff --git a/deploy/serviceaccount.yaml b/deploy/serviceaccount.yaml
deleted file mode 100644
index fbe087c..0000000
--- a/deploy/serviceaccount.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tack
-  namespace: tack