diff --git a/apps/base/ghp/configmap.yaml b/apps/base/ghp/configmap.yaml
index f35f4ed..4cc2947 100644
--- a/apps/base/ghp/configmap.yaml
+++ b/apps/base/ghp/configmap.yaml
@@ -19,4 +19,4 @@ data:
   GHP_TLS_CERT_FILE: /etc/ghp/tls/tls.crt
   GHP_TLS_KEY_FILE: /etc/ghp/tls/tls.key
   # PLACEHOLDER: set to Ben's GitHub username before ghp will admit an admin.
-  GHP_ADMINS: "REPLACE_ME_ben_github_username"
+  GHP_ADMINS: "neoloc"
diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml
index ab4013b..1a7f5b2 100644
--- a/apps/base/ghp/deployment.yaml
+++ b/apps/base/ghp/deployment.yaml
@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ghp
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0
+          image: ghcr.io/goodtune/ghp:0.20.0
           imagePullPolicy: IfNotPresent
           # Drop the image's default --migrate so replicas never race migrations;
           # schema is applied by the wave-1 migrate hook Job instead.
@@ -102,7 +102,7 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTP
+              scheme: HTTPS
             initialDelaySeconds: 30
             periodSeconds: 30
             successThreshold: 1
@@ -112,7 +112,7 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTP
+              scheme: HTTPS
             initialDelaySeconds: 10
             periodSeconds: 5
             successThreshold: 1
diff --git a/apps/base/ghp/migrate-job.yaml b/apps/base/ghp/migrate-job.yaml
index 443feef..ef8438c 100644
--- a/apps/base/ghp/migrate-job.yaml
+++ b/apps/base/ghp/migrate-job.yaml
@@ -37,7 +37,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0
+          image: ghcr.io/goodtune/ghp:0.20.0
           imagePullPolicy: IfNotPresent
           command: ["/ghp", "migrate"]
           env:
diff --git a/apps/base/ghp/vmservicescrape.yaml b/apps/base/ghp/vmservicescrape.yaml
index a91bde9..e5ca485 100644
--- a/apps/base/ghp/vmservicescrape.yaml
+++ b/apps/base/ghp/vmservicescrape.yaml
@@ -16,3 +16,8 @@ spec:
   endpoints:
     - port: metrics
       path: /metrics
+      scheme: https
+      # ghp serves metrics over TLS with an internal-CA cert; skip verification
+      # since the scrape targets a pod IP the cert SANs do not cover.
+      tlsConfig:
+        insecureSkipVerify: true