diff --git a/ansible/roles/gitea/defaults/main.yml b/ansible/roles/gitea/defaults/main.yml
index 7f0db62..c8598fc 100644
--- a/ansible/roles/gitea/defaults/main.yml
+++ b/ansible/roles/gitea/defaults/main.yml
@@ -6,6 +6,10 @@
 # Directory layout on mad-tea-party
 gitea_compose_dir: /opt/gitea
 
+# Image versions
+gitea_version: "28.2.0"
+gitea_postgres_version: "17.11"
+
 # Gitea application settings
 gitea_domain: gitea.mk-labs.cloud
 gitea_root_url: "https://{{ gitea_domain }}"
diff --git a/ansible/roles/gitea/tasks/main.yml b/ansible/roles/gitea/tasks/main.yml
index 46c412d..f133efa 100644
--- a/ansible/roles/gitea/tasks/main.yml
+++ b/ansible/roles/gitea/tasks/main.yml
@@ -15,9 +15,9 @@
 
 # ── Compose & env ──────────────────────────────────────────────────────────────
 
-- name: Deploy Gitea compose file from boilerplate
-  ansible.builtin.copy:
-    src: "{{ playbook_dir }}/../../boilerplates/gitea/compose.yaml"
+- name: Deploy Gitea compose file
+  ansible.builtin.template:
+    src: compose.yaml.j2
     dest: "{{ gitea_compose_dir }}/compose.yaml"
     owner: root
     group: root
diff --git a/ansible/roles/gitea/templates/compose.yaml.j2 b/ansible/roles/gitea/templates/compose.yaml.j2
new file mode 100644
index 0000000..6444e46
--- /dev/null
+++ b/ansible/roles/gitea/templates/compose.yaml.j2
@@ -0,0 +1,64 @@
+# ------------------------------------------------------------------------------
+# FILE: ansible/roles/gitea/templates/compose.yaml.j2
+# DESCRIPTION: Gitea + PostgreSQL compose stack. Values come from role defaults.
+#              Postgres stays on 17.x; a major bump needs dump + restore.
+# ------------------------------------------------------------------------------
+
+services:
+  gitea:
+    image: docker.io/gitea/gitea:{{ gitea_version }}
+    restart: unless-stopped
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=gitea_db
+      - GITEA__database__NAME={{ gitea_db_name }}
+      - GITEA__database__USER={{ gitea_db_user }}
+      - GITEA__database__PASSWD=${DATABASE_PASSWORD}
+      - GITEA__server__SSH_PORT={{ gitea_ssh_port }}
+      - GITEA__server__ROOT_URL={{ gitea_root_url }}
+      - GITEA__server__DOMAIN={{ gitea_domain }}
+      - GITEA__server__HTTP_PORT={{ gitea_http_port }}
+      - GITEA__service__TRUSTED_PROXIES={{ gitea_trusted_proxies }}
+    networks:
+      - gitea_backend
+    ports:
+      - "{{ gitea_http_port }}:{{ gitea_http_port }}"
+      - "{{ gitea_ssh_port }}:22"
+    volumes:
+      - gitea_data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    depends_on:
+      gitea_db:
+        condition: service_healthy
+
+  gitea_db:
+    image: docker.io/library/postgres:{{ gitea_postgres_version }}
+    restart: unless-stopped
+    environment:
+      - TZ={{ gitea_timezone }}
+      - POSTGRES_USER={{ gitea_db_user }}
+      - POSTGRES_PASSWORD=${DATABASE_PASSWORD}
+      - POSTGRES_DB={{ gitea_db_name }}
+    networks:
+      - gitea_backend
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U {{ gitea_db_user }}"]
+      start_period: 30s
+      interval: 10s
+      timeout: 10s
+      retries: 5
+    volumes:
+      - gitea_db:/var/lib/postgresql/data
+
+volumes:
+  gitea_data:
+    driver: local
+  gitea_db:
+    driver: local
+
+networks:
+  gitea_backend:
+    driver: bridge
diff --git a/boilerplates/gitea/compose.yaml b/boilerplates/gitea/compose.yaml
deleted file mode 100644
index 3b9d224..0000000
--- a/boilerplates/gitea/compose.yaml
+++ /dev/null
@@ -1,58 +0,0 @@
-services:
-  gitea:
-    image: docker.io/gitea/gitea:1.25.4
-    restart: unless-stopped
-    environment:
-      - USER_UID=1000
-      - USER_GID=1000
-      - GITEA__database__DB_TYPE=postgres
-      - GITEA__database__HOST=gitea_db
-      - GITEA__database__NAME=gitea
-      - GITEA__database__USER=gitea
-      - GITEA__database__PASSWD=${DATABASE_PASSWORD}
-      - GITEA__server__SSH_PORT=2221
-      - GITEA__server__ROOT_URL=https://gitea.mk-labs.cloud
-      - GITEA__server__DOMAIN=gitea.mk-labs.cloud
-      - GITEA__server__HTTP_PORT=3000
-      - GITEA__service__TRUSTED_PROXIES=10.1.71.35
-    networks:
-      - gitea_backend
-    ports:
-      - "3000:3000"
-      - "2221:22"
-    volumes:
-      - gitea_data:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    depends_on:
-      gitea_db:
-        condition: service_healthy
-
-  gitea_db:
-    image: docker.io/library/postgres:17.8
-    restart: unless-stopped
-    environment:
-      - TZ=America/Chicago
-      - POSTGRES_USER=gitea
-      - POSTGRES_PASSWORD=${DATABASE_PASSWORD}
-      - POSTGRES_DB=gitea
-    networks:
-      - gitea_backend
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U gitea"]
-      start_period: 30s
-      interval: 10s
-      timeout: 10s
-      retries: 5
-    volumes:
-      - gitea_db:/var/lib/postgresql/data
-
-volumes:
-  gitea_data:
-    driver: local
-  gitea_db:
-    driver: local
-
-networks:
-  gitea_backend:
-    driver: bridge