diff --git a/changelog/v0.10.24.md b/changelog/v0.10.24.md
new file mode 100644
index 0000000..25010ba
--- /dev/null
+++ b/changelog/v0.10.24.md
@@ -0,0 +1,11 @@
+# v0.10.24
+
+**Released:** 2026-02-01
+
+## Changes
+
+fix: woodpecker YAML marker format
+
+---
+
+**Image:** `ghcr.io/orchard9/rdev-api:v0.10.24`
diff --git a/deployments/k8s/base/rdev-api.yaml b/deployments/k8s/base/rdev-api.yaml
index 95c1d4b..456f5a5 100644
--- a/deployments/k8s/base/rdev-api.yaml
+++ b/deployments/k8s/base/rdev-api.yaml
@@ -24,7 +24,7 @@ spec:
       serviceAccountName: rdev-api
       containers:
         - name: rdev-api
-          image: ghcr.io/orchard9/rdev-api:v0.10.23
+          image: ghcr.io/orchard9/rdev-api:v0.10.24
           imagePullPolicy: Always
 
           ports:
@@ -94,6 +94,9 @@ spec:
                   name: rdev-credentials
                   key: CREDENTIAL_ENCRYPTION_KEY
             # Infrastructure adapters for threesix.ai (fallback if not in DB)
+            # Note: Using internal service hostnames to avoid hairpin NAT issues
+            - name: GITEA_URL
+              value: "http://gitea.threesix.svc.cluster.local"
             - name: GITEA_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -115,7 +118,7 @@ spec:
                   name: rdev-credentials
                   key: WOODPECKER_WEBHOOK_SECRET
             - name: WOODPECKER_URL
-              value: "https://ci.threesix.ai"
+              value: "http://woodpecker-server.threesix.svc.cluster.local:8000"
             - name: WOODPECKER_API_TOKEN
               valueFrom:
                 secretKeyRef: