diff --git a/lotus-land-story/quire.yml b/lotus-land-story/quire.yml
index 06bf8d8..40df084 100644
--- a/lotus-land-story/quire.yml
+++ b/lotus-land-story/quire.yml
@@ -2,7 +2,8 @@
 - name: Set up Quire
   hosts: lotus-land-story
   vars:
-    version: 20260427-068b215
+    # TODO Pin the version once we're not in active development anymore
+    version: latest
   tasks:
 
     - name: Create quire user
@@ -25,19 +26,28 @@
         mode: "0700"
         owner: "{{ quire_user.name }}"
 
-    - name: Write github_token secret
+    - name: Write secrets
       ansible.builtin.copy:
-        content: "{{ quire.github_pat }}"
-        dest: /mnt/lotus-land-story/quire/secrets/github_token
+        content: "{{ item.content }}"
+        dest: "/mnt/lotus-land-story/quire/secrets/{{ item.name }}"
         mode: "0600"
         owner: "{{ quire_user.name }}"
+      loop:
+        - name: github_token
+          content: "{{ quire.github_pat }}"
+        - name: github_auth_header
+          content: "{{ quire.github_auth_header }}"
+      loop_control:
+        label: "{{ item.name }}"
       no_log: true
 
     - name: Write quire config
       ansible.builtin.copy:
         content: |
-          {:github {:token {:file "/var/quire/secrets/github_token"}}
-           :sentry {:dsn "{{ quire.sentry_dsn }}"}}
+          {:secrets {:github_token {:file "/var/quire/secrets/github_token"}
+                     :github_auth_header {:file "/var/quire/secrets/github_auth_header"}}
+           :sentry {:dsn "{{ quire.sentry_dsn }}"}
+           :ci {:transport :api}}
         dest: /mnt/lotus-land-story/quire/config.fnl
         mode: "0644"
         owner: "{{ quire_user.name }}"
@@ -49,6 +59,11 @@
         groups: docker
         append: true
 
+    - name: Look up docker group
+      ansible.builtin.getent:
+        database: group
+        key: docker
+
     - name: Add SSH keys for quire user
       ansible.posix.authorized_key:
         user: quire
@@ -71,15 +86,20 @@
     - name: Run Quire
       community.docker.docker_container:
         name: quire
-        image: ghcr.io/kejadlen/quire:{{ version }}
-        env: {}
+        image: ghcr.io/kejadlen/quire:{{ version }} 
+        pull: always
+        env:
+          QUIRE_LOG: INFO
         volumes:
           - /mnt/lotus-land-story/quire:/var/quire
+          - /var/run/docker.sock:/var/run/docker.sock
         networks:
           - name: lotus_land_story
         restart_policy: unless-stopped
         state: started
         user: "{{ quire_user.uid }}"
+        groups:
+          - "{{ ansible_facts.getent_group.docker[1] }}"
 
     - name: Run quire-gitweb
       community.docker.docker_container:
diff --git a/lotus-land-story/templates/Caddyfile b/lotus-land-story/templates/Caddyfile
index cf0abcd..778cbd0 100644
--- a/lotus-land-story/templates/Caddyfile
+++ b/lotus-land-story/templates/Caddyfile
@@ -193,18 +193,19 @@ files.chislan.family {
 git.kejadlen.dev {
 	log
 
-	# rate_limit {
-	# 	zone rate_limit {
-	# 		match {
-	# 			# not tailscale
-	# 			not client_ip 100.64.0.0/10
-	# 		}
-	# 		key static
-	# 		events 50
-	# 		window 1m
-	# 		log_key
-	# 	}
-	# }
+	# Meta's web indexer hammers gitea's blame/diff endpoints hard enough
+	# to spike load; throttle it to one request per minute per source IP.
+	rate_limit {
+		zone meta_webindexer {
+			match {
+				header User-Agent meta-webindexer/*
+			}
+			key    {http.request.remote.host}
+			events 1
+			window 1m
+			log_key
+		}
+	}
 
 	# hacky way to reverse auth only from my laptop
 	@undefined-fantastic-object client_ip {{ undefined_fantastic_object_ip }}