diff --git a/.github/workflows/sync-to-forgejo.yml b/.github/workflows/sync-to-forgejo.yml
index 07b6182..a7e7fe8 100644
--- a/.github/workflows/sync-to-forgejo.yml
+++ b/.github/workflows/sync-to-forgejo.yml
@@ -33,6 +33,14 @@ jobs:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
         run: |
           set -euo pipefail
-          git remote add forgejo "https://admin:${FORGEJO_TOKEN}@ci.nxtgauge.com/ashwin/${{ github.event.repository.name }}.git" 2>/dev/null || \
-            git remote set-url forgejo "https://admin:${FORGEJO_TOKEN}@ci.nxtgauge.com/ashwin/${{ github.event.repository.name }}.git"
-          git push forgejo "HEAD:${GITHUB_REF#refs/heads/}" --force
+          BRANCH="${GITHUB_REF#refs/heads/}"
+          REMOTE_URL="https://admin:${FORGEJO_TOKEN}@ci.nxtgauge.com/ashwin/${{ github.event.repository.name }}.git"
+
+          git remote add forgejo "$REMOTE_URL" 2>/dev/null || git remote set-url forgejo "$REMOTE_URL"
+
+          git fetch forgejo "$BRANCH" || true
+          if git show-ref --verify --quiet "refs/remotes/forgejo/$BRANCH"; then
+            git rebase "refs/remotes/forgejo/$BRANCH"
+          fi
+
+          git push forgejo "HEAD:$BRANCH"
diff --git a/apps/traceworks2026/README.md b/apps/traceworks2026/README.md
new file mode 100644
index 0000000..2bdda06
--- /dev/null
+++ b/apps/traceworks2026/README.md
@@ -0,0 +1,17 @@
+# Traceworks2026 GitOps
+
+This app is deployed from `apps/traceworks2026/overlays/prod`.
+
+Flux image automation watches these Forgejo registry images:
+
+- `ci.nxtgauge.com/admin/traceworks2026-frontend`
+- `ci.nxtgauge.com/admin/traceworks2026-api`
+
+Expected CI flow:
+
+1. GitHub mirrors the app repo to Forgejo.
+2. Forgejo Actions builds and pushes timestamped image tags.
+3. Flux updates `overlays/prod/release-patch.yaml` to the newest tags.
+4. Flux applies the updated manifests to the cluster.
+
+Before this works in-cluster, create a `forgejo-regcred` secret in the `flux-system` namespace so Flux can read the private registry.
diff --git a/apps/traceworks2026/base/api-deployment.yaml b/apps/traceworks2026/base/api-deployment.yaml
new file mode 100644
index 0000000..fb6ead6
--- /dev/null
+++ b/apps/traceworks2026/base/api-deployment.yaml
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traceworks-api
+  namespace: traceworks
+  labels:
+    app: traceworks-api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traceworks-api
+  template:
+    metadata:
+      labels:
+        app: traceworks-api
+    spec:
+      imagePullSecrets:
+        - name: forgejo-regcred
+      containers:
+        - name: api
+          image: ci.nxtgauge.com/admin/traceworks2026-api:19700101000000-000000000000
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3001
+              name: http
+          envFrom:
+            - secretRef:
+                name: traceworks-api-env
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 3001
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 3001
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
diff --git a/apps/traceworks2026/base/api-secret.example.yaml b/apps/traceworks2026/base/api-secret.example.yaml
new file mode 100644
index 0000000..ad48a0c
--- /dev/null
+++ b/apps/traceworks2026/base/api-secret.example.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: traceworks-api-env
+  namespace: traceworks
+type: Opaque
+stringData:
+  RESEND_API_KEY: replace_me
+  RESEND_FROM_EMAIL: Traceworks <onboarding@resend.dev>
+  RESEND_TO_EMAIL: ashwin@traceworks.in
diff --git a/apps/traceworks2026/base/api-service.yaml b/apps/traceworks2026/base/api-service.yaml
new file mode 100644
index 0000000..cb35f96
--- /dev/null
+++ b/apps/traceworks2026/base/api-service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traceworks-api
+  namespace: traceworks
+spec:
+  selector:
+    app: traceworks-api
+  ports:
+    - name: http
+      port: 3001
+      targetPort: 3001
diff --git a/apps/traceworks2026/base/frontend-deployment.yaml b/apps/traceworks2026/base/frontend-deployment.yaml
new file mode 100644
index 0000000..b8372dd
--- /dev/null
+++ b/apps/traceworks2026/base/frontend-deployment.yaml
@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traceworks-frontend
+  namespace: traceworks
+  labels:
+    app: traceworks-frontend
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: traceworks-frontend
+  template:
+    metadata:
+      labels:
+        app: traceworks-frontend
+    spec:
+      imagePullSecrets:
+        - name: forgejo-regcred
+      containers:
+        - name: nginx
+          image: ci.nxtgauge.com/admin/traceworks2026-frontend:19700101000000-000000000000
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
diff --git a/apps/traceworks2026/base/frontend-service.yaml b/apps/traceworks2026/base/frontend-service.yaml
new file mode 100644
index 0000000..8b0cf99
--- /dev/null
+++ b/apps/traceworks2026/base/frontend-service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traceworks-frontend
+  namespace: traceworks
+spec:
+  selector:
+    app: traceworks-frontend
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
diff --git a/apps/traceworks2026/base/ingress.yaml b/apps/traceworks2026/base/ingress.yaml
new file mode 100644
index 0000000..d6ca5e9
--- /dev/null
+++ b/apps/traceworks2026/base/ingress.yaml
@@ -0,0 +1,35 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: traceworks
+  namespace: traceworks
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - traceworks.in
+        - www.traceworks.in
+      secretName: traceworks-tls
+  rules:
+    - host: traceworks.in
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: traceworks-frontend
+                port:
+                  number: 80
+    - host: www.traceworks.in
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: traceworks-frontend
+                port:
+                  number: 80
diff --git a/apps/traceworks2026/base/kustomization.yaml b/apps/traceworks2026/base/kustomization.yaml
new file mode 100644
index 0000000..04a5af9
--- /dev/null
+++ b/apps/traceworks2026/base/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: traceworks
+resources:
+  - namespace.yaml
+  - frontend-deployment.yaml
+  - frontend-service.yaml
+  - api-deployment.yaml
+  - api-service.yaml
+  - ingress.yaml
diff --git a/apps/traceworks2026/base/namespace.yaml b/apps/traceworks2026/base/namespace.yaml
new file mode 100644
index 0000000..8ca94b0
--- /dev/null
+++ b/apps/traceworks2026/base/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traceworks
diff --git a/apps/traceworks2026/overlays/prod/kustomization.yaml b/apps/traceworks2026/overlays/prod/kustomization.yaml
new file mode 100644
index 0000000..8280c47
--- /dev/null
+++ b/apps/traceworks2026/overlays/prod/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: traceworks
+resources:
+  - ../../base
+patches:
+  - path: release-patch.yaml
diff --git a/apps/traceworks2026/overlays/prod/release-patch.yaml b/apps/traceworks2026/overlays/prod/release-patch.yaml
new file mode 100644
index 0000000..bbacbe1
--- /dev/null
+++ b/apps/traceworks2026/overlays/prod/release-patch.yaml
@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traceworks-frontend
+  namespace: traceworks
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: ci.nxtgauge.com/admin/traceworks2026-frontend:19700101000000-000000000000 # {"$imagepolicy": "flux-system:traceworks2026-frontend"}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traceworks-api
+  namespace: traceworks
+spec:
+  template:
+    spec:
+      containers:
+        - name: api
+          image: ci.nxtgauge.com/admin/traceworks2026-api:19700101000000-000000000000 # {"$imagepolicy": "flux-system:traceworks2026-api"}
diff --git a/clusters/production/flux-system/forgejo-regcred.example.yaml b/clusters/production/flux-system/forgejo-regcred.example.yaml
new file mode 100644
index 0000000..0ded1eb
--- /dev/null
+++ b/clusters/production/flux-system/forgejo-regcred.example.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: forgejo-regcred
+  namespace: flux-system
+type: kubernetes.io/dockerconfigjson
+stringData:
+  .dockerconfigjson: '{"auths":{"ci.nxtgauge.com":{"username":"admin","password":"replace_me","auth":"replace_me_base64"}}}'
diff --git a/clusters/production/flux-system/traceworks2026-image-automation.yaml b/clusters/production/flux-system/traceworks2026-image-automation.yaml
new file mode 100644
index 0000000..ff89c7a
--- /dev/null
+++ b/clusters/production/flux-system/traceworks2026-image-automation.yaml
@@ -0,0 +1,76 @@
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+  name: traceworks2026-frontend
+  namespace: flux-system
+spec:
+  image: ci.nxtgauge.com/admin/traceworks2026-frontend
+  interval: 1m0s
+  secretRef:
+    name: forgejo-regcred
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+  name: traceworks2026-frontend
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: traceworks2026-frontend
+  filterTags:
+    pattern: '^[0-9]{14}-[a-f0-9]{12}$'
+  policy:
+    alphabetical:
+      order: asc
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+  name: traceworks2026-api
+  namespace: flux-system
+spec:
+  image: ci.nxtgauge.com/admin/traceworks2026-api
+  interval: 1m0s
+  secretRef:
+    name: forgejo-regcred
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+  name: traceworks2026-api
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: traceworks2026-api
+  filterTags:
+    pattern: '^[0-9]{14}-[a-f0-9]{12}$'
+  policy:
+    alphabetical:
+      order: asc
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageUpdateAutomation
+metadata:
+  name: traceworks2026
+  namespace: flux-system
+spec:
+  interval: 2m0s
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  git:
+    checkout:
+      ref:
+        branch: main
+    commit:
+      author:
+        email: fluxcdbot@nxtgauge.com
+        name: FluxCD Image Automation
+      messageTemplate: 'Update Traceworks2026 images
+
+Automation: {{range .Updated.Images}}{{println .}}{{end}}'
+    push:
+      branch: main
+  update:
+    path: ./apps/traceworks2026/overlays/prod
+    strategy: Setters
diff --git a/clusters/production/kustomization.yaml b/clusters/production/kustomization.yaml
index 0afafc4..5fea507 100644
--- a/clusters/production/kustomization.yaml
+++ b/clusters/production/kustomization.yaml
@@ -9,3 +9,5 @@ resources:
   - ../../apps/github-actions-runners/base
   - ../../apps/ollama/base
   - ../../ops/openobserve-alerts
+  - flux-system/traceworks2026-image-automation.yaml
+  - ../../apps/traceworks2026/overlays/prod