diff --git a/README.md b/README.md
index c9e7c86..79bee9f 100644
--- a/README.md
+++ b/README.md
@@ -34,23 +34,16 @@ deploy-db.sh
 README.md
 ```
 
-## Database
+# Database
 
 The app connects to a PostgreSQL database using the `DATABASE_URL` environment variable.
 
-### Deploy / rotate the database secret on Kubernetes
+Kubernetes runtime uses:
 
-Run the helper script. It generates a secure random password, encrypts it to `~/.lahuasca-db-pass.enc`, and applies it to the `la-huasca-db-secrets` secret in the `la-huasca` namespace.
-
-```bash
-./deploy-db.sh
-```
-
-To reveal the stored password, use the PIN `78963`:
-
-```bash
-./deploy-db.sh reveal
-```
+- namespace: `lahuasca`
+- Postgres: 15, PVC-backed
+- app secrets: `calendar-db-secrets`, key `url`
+- ingress: Traefik on `lahuasca.com`
 
 ### Initialize the database schema and seed data
 
@@ -66,6 +59,8 @@ To reset everything (drops and recreates tables with seed data):
 curl -X POST "http://localhost:3000/api/db/init?reset=true"
 ```
 
+Note: database initialization is blocked in production. Use `reset=true` only if you actually want schema reinitialization.
+
 ## Authentication
 
 The app includes JWT-based session authentication backed by the database. Demo accounts are seeded automatically:
diff --git a/deploy-db.sh b/deploy-db.sh
index f1b1895..b679da1 100755
--- a/deploy-db.sh
+++ b/deploy-db.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 # Deploy Postgres for la-huasca in its own namespace
 
-NAMESPACE="la-huasca"
+NAMESPACE="lahuasca"
 SECRET_NAME="la-huasca-db-secrets"
 PVC_NAME="postgres-data"
 
diff --git a/deploy.sh b/deploy.sh
index 474053a..d20c38a 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -12,7 +12,7 @@ set -euo pipefail
 #   - docker or buildah/push capability (we build locally and push)
 #   - registry secret exists or REGISTRY_USER/REGISTRY_PASS are exported
 
-NAMESPACE="la-huasca"
+NAMESPACE="lahuasca"
 IMAGE="gitea.ajavasoft.com/muken/la-huasca-ts"
 TAG="${TAG:-$(git rev-parse --short HEAD)}"
 HOSTS=("lahuasca.com" "www.lahuasca.com")
diff --git a/k8s/app.yaml b/k8s/app.yaml
index 7c5b76b..91b221c 100644
--- a/k8s/app.yaml
+++ b/k8s/app.yaml
@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: la-huasca-ts
-  namespace: la-huasca-ts
+  namespace: lahuasca
 spec:
   replicas: 1
   selector:
@@ -29,18 +29,6 @@ spec:
                 secretKeyRef:
                   name: calendar-db-secrets
                   key: url
-          readinessProbe:
-            httpGet:
-              path: /api/health
-              port: http
-            initialDelaySeconds: 20
-            periodSeconds: 15
-          livenessProbe:
-            httpGet:
-              path: /api/health
-              port: http
-            initialDelaySeconds: 60
-            periodSeconds: 30
           resources:
             requests:
               cpu: 200m
@@ -53,7 +41,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: la-huasca-ts
-  namespace: la-huasca-ts
+  namespace: lahuasca
 spec:
   ports:
     - port: 80
@@ -67,17 +55,17 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: la-huasca-ts
-  namespace: la-huasca-ts
+  namespace: lahuasca
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
 spec:
   ingressClassName: traefik
   tls:
     - hosts:
-        - la-huasca.ajavasoft.com
+        - lahuasca.com
       secretName: la-huasca-ts-tls
   rules:
-    - host: la-huasca.ajavasoft.com
+    - host: lahuasca.com
       http:
         paths:
           - path: /