diff --git a/CLAUDE.md b/CLAUDE.md
index 023c0a1..bb73139 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -53,6 +53,16 @@ Some important places you can look:
 ~/code/work  # FORBIDDEN, never go here, avoid searching it
 ```
 
+## Third-Party Projects
+
+When a task requires cloning or using a third-party git repository (e.g., for building from source), **ask the user to mirror it on forge first**, then clone from the mirror:
+- Mirror location: `https://forge.tail8d86e.ts.net/eblume/<project>.git`
+- Clone to: `~/code/3rd/<project>/`
+
+This avoids external dependencies and ensures the project is available even if the upstream is unreachable. Example mirrors:
+- `https://forge.tail8d86e.ts.net/eblume/zot.git` (container registry)
+- `https://forge.tail8d86e.ts.net/eblume/mcquack.git` (LaunchAgent helper)
+
 ## Task Discovery
 
 To discover pending blumeops tasks, run:
diff --git a/docs/k8s-migration.md b/docs/k8s-migration.md
index 20ec9e0..23990b3 100644
--- a/docs/k8s-migration.md
+++ b/docs/k8s-migration.md
@@ -159,8 +159,8 @@ tailscale status | grep registry
 # Ensure Go is installed (via mise or homebrew)
 ssh indri 'go version'
 
-# Clone zot repository
-ssh indri 'git clone https://github.com/project-zot/zot.git ~/code/3rd/zot'
+# Clone zot from forge mirror (not GitHub - avoids external dependency)
+ssh indri 'git clone https://forge.tail8d86e.ts.net/eblume/zot.git ~/code/3rd/zot'
 
 # Build (creates bin/zot-darwin-arm64)
 ssh indri 'cd ~/code/3rd/zot && make binary'