diff --git a/.env.example b/.env.example
index a279367..c7cfae9 100644
--- a/.env.example
+++ b/.env.example
@@ -7,6 +7,7 @@ HTTPS_PORT=8643
 # Used only with compose.direct.yaml or ./manage.sh start-direct.
 BROKER_DIRECT_PORT=8080
 GITEA_DIRECT_PORT=3000
+GITEA_DIRECT_ROOT_URL=http://localhost:3000/
 
 # letsencrypt: manage a certificate automatically with Certbot.
 # custom: read the named certificate files from ./config/ssl.
diff --git a/compose.direct.yaml b/compose.direct.yaml
index 3179fe2..9935056 100644
--- a/compose.direct.yaml
+++ b/compose.direct.yaml
@@ -7,3 +7,6 @@ services:
   gitea:
     ports:
       - "${GITEA_DIRECT_PORT:-3000}:3000"
+    environment:
+      GITEA__server__ROOT_URL: ${GITEA_DIRECT_ROOT_URL:-http://localhost:3000/}
+      GITEA__session__COOKIE_SECURE: "false"
diff --git a/compose.yaml b/compose.yaml
index 5b7dbcf..56475a5 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -45,6 +45,7 @@ services:
       GITEA__server__HTTP_ADDR: 0.0.0.0
       GITEA__server__HTTP_PORT: "3000"
       GITEA__server__DISABLE_SSH: "true"
+      GITEA__session__COOKIE_SECURE: "true"
       GITEA__service__DISABLE_REGISTRATION: "true"
       GITEA__security__INSTALL_LOCK: "true"
     security_opt:
diff --git a/docs/deployment.md b/docs/deployment.md
index a322879..67dc819 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -127,15 +127,27 @@ Gitea uses its own SQLite database at
 `config/gitea/data/data/gitea.db`.
 
 For local testing that bypasses Nginx, set `BROKER_DIRECT_PORT` and
-`GITEA_DIRECT_PORT` in `.env`, then run:
+`GITEA_DIRECT_PORT` in `.env`. Set `GITEA_DIRECT_ROOT_URL` to the exact URL the
+test browser will use, including the VM hostname or IP address and port:
+
+```dotenv
+BROKER_DIRECT_PORT=8080
+GITEA_DIRECT_PORT=3000
+GITEA_DIRECT_ROOT_URL=http://192.0.2.10:3000/
+```
+
+Then run:
 
 ```sh
 ./manage.sh start-direct
 ```
 
-This adds host mappings to the broker's port 8080 and Gitea's port 3000. Do not
-use the direct-port override on an Internet-facing production VM. Return to the
-production port layout with:
+This adds host mappings to the broker's port 8080 and Gitea's port 3000. It
+also changes Gitea's root URL and session cookie policy to permit HTTP login.
+The direct broker port is suitable for health and API testing; technician
+OAuth login remains designed for the HTTPS public URL. Do not use the
+direct-port override on an Internet-facing production VM. Return to the
+production URL and secure-cookie policy with:
 
 ```sh
 ./manage.sh start
@@ -184,9 +196,10 @@ cd /YOUR/INSTALL/PARENT/TA-Deployment-Access
 ```
 
 The updater operates only on the current VM. It fast-forwards the checked-out
-branch, pulls the pinned Gitea image, rebuilds and restarts the local stack, and
-waits for the local broker to become healthy. It has no peer discovery, SSH, or
-multi-node update behavior.
+branch, pulls the pinned Gitea and Nginx images, rebuilds and restarts the local
+stack, and waits for the local broker to become healthy. Certbot is not pulled
+or run during a routine update; it is used only by `bootstrap` and `renew`. The
+updater has no peer discovery, SSH, or multi-node update behavior.
 
 Pin image versions as supplied and review release notes before changing them.
 Never change Gitea between rootless and rootful image families in place.
diff --git a/update.sh b/update.sh
index 739c118..357bcac 100755
--- a/update.sh
+++ b/update.sh
@@ -54,7 +54,7 @@ if ((post_pull == 0)); then
 fi
 
 printf 'Updating the local Gitea image and deployment stack...\n'
-docker compose --env-file .env pull gitea nginx certbot
+docker compose --env-file .env pull gitea nginx
 "${DEPLOY_ROOT}/manage.sh" start
 
 container_id="$(docker compose -f compose.yaml -f compose.tls.yaml ps -q broker)"