diff --git a/docs/chart-ownership.md b/docs/chart-ownership.md
index 3bf70e3..c66f732 100644
--- a/docs/chart-ownership.md
+++ b/docs/chart-ownership.md
@@ -15,14 +15,21 @@ configuration are baked into distinct immutable images; pods never download
 application code at startup.
 
 Maintained chart repositories set `Chart.yaml.appVersion` to the tested
-application/image version. CI derives the chart package version from Git:
+application/image version. The chart repository's base Git tag follows the
+application release, not an invented chart `v1.0.0`. CI derives the chart
+package version from Git:
 
-- tag `v1.0.0` produces chart `1.0.0`;
+- for Diun 4.33.0, tag `v4.33.0` produces chart `4.33.0`;
 - the next commit produces a unique version such as
-  `1.0.0-1-g41627abcdef`.
+  `4.33.0-1-g41627abcdef`.
+
+`appVersion` remains the exact upstream/image version. If that version is a
+date, commit hash, or other non-SemVer string, choose and document a
+SemVer-compatible chart tag derived from it; do not silently substitute
+`1.0.0`.
 
 The target layout is one repository per maintained chart, with tags such as
-`v1.0.0`. Existing shared repositories are legacy, not a template for new
+`v4.33.0`. Existing shared repositories are legacy, not a template for new
 charts.
 
 The hash is retained to prevent package-version collisions. CI publishes to
@@ -42,11 +49,15 @@ publication, then verify both `homelab-bootstrap` and the new Application are
 Synced and Healthy.
 
 If Gitea Actions fails, inspect the failed job's steps and logs before asking
-for help or changing the workflow. On arschrock, Gitea's local admin CLI can
-create scoped tokens for repository Actions secrets; see the workspace
-`AGENTS.md` for the command, API path, and secret handling rules. Complete the
-CI rerun, chart publication, GitOps promotion, Argo rollout, ready containers,
-exact image tag, and PVC UID/volume check before declaring a migration done.
+for help or changing the workflow. On arschrock, Gitea's local admin CLI is
+available through `sudo -n -u gitea /usr/bin/gitea -c /etc/gitea/app.ini`;
+use its `admin user generate-access-token --help` command to create scoped
+package and GitOps tokens. Set repository Actions secrets through
+`PUT /api/v1/repos/{owner}/{repo}/actions/secrets/{name}` without printing raw
+tokens. The workspace `AGENTS.md` has the full diagnostic procedure. Complete
+the CI rerun, chart publication, GitOps promotion, Argo rollout, ready
+containers, exact image tag, and PVC UID/volume check before declaring a
+migration done.
 
 GitOps values may select namespaces, hostnames, ingress integration, existing
 claims or storage classes/sizes, resource sizing, replica counts, monitoring