diff --git a/README.md b/README.md
index d7c0bb2..1482201 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,7 @@ secrets.env.example       template for the host-local secrets file
 git push origin test
     │
     ▼
-Gitea push webhook ──► http://10.255.255.1:20090/hooks/webdev-domaindingo
+Gitea push webhook ──► http://10.255.255.1:21600/hooks/webdev-domaindingo
     │                  (WireGuard only; never exposed publicly)
     ▼
 adnanh/webhook       verify HMAC-SHA256, require X-Gitea-Event: push,
@@ -104,7 +104,7 @@ Requires `adnanh/webhook` on `PATH` (or `WEBHOOK_BIN` set), plus `docker`,
 `python3`, `curl` and `flock`.
 
 ```bash
-git clone ssh://git@gitea.fisher.hu:2221/sysadmin/my-cd-webhook.git ~/S/my-cd-webhook
+git clone ssh://git@gitea.fisher.hu:2221/fisher/my-cd-webhook.git ~/S/my-cd-webhook
 cd ~/S/my-cd-webhook
 ./install/install.sh          # creates the secrets template on the first run
 $EDITOR ~/.config/cd-webhook/secrets.env
@@ -119,7 +119,7 @@ It prints the exact webhook URL for each repository at the end. In Gitea, under
 
 | Field | Value |
 |---|---|
-| Target URL | `http://<host wg ip>:20090/hooks/<id>` |
+| Target URL | `http://<host wg ip>:21600/hooks/<id>` |
 | HTTP Method | `POST` |
 | POST Content Type | `application/json` |
 | Secret | the matching value from `secrets.env` |
@@ -162,10 +162,14 @@ changes which manifest is read, never which host this machine may act as.
 
 ## Not yet done
 
-- **Port `20090` is not yet in the Port registry.** Register it before this goes
-  live on a second host.
-- **Gitea (s5) must be able to reach s4 on `10.255.255.12:20090`** over
+- **Port `21600` is proposed, not allocated.** The Port registry's rule is to
+  claim a block only once the service is deployed and listening, as part of the
+  same change. `21600-21699` is the lowest free block in the `21500-21999` pool;
+  verify it is still free on the host (`ss -lntup`) when installing, then add
+  both the block row and a per-project table to the registry.
+- **Gitea (s5) must be able to reach s4 on `10.255.255.12:21600`** over
   WireGuard. Verify before adding grindex.
+- **`adnanh/webhook` is not installed on s4 or s5.** Nothing runs yet.
 - **grindex is deliberately absent from the manifest.** Its stack lives at
   `/home/fisher/S/traefik-systems/grindex/` on s4, which is not in git and whose
   compose project names have not been verified on the host. Adding it from
diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
index a98aaac..9927241 100644
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@@ -74,7 +74,7 @@ missed deploy, not a wrong one.
 ## Adding a host
 
 1. Add the host to `"hosts"` in `targets.json` with its WireGuard address and
-   port `20090`.
+   port `21600`.
 2. Add its targets.
 3. Commit and push this repository.
 4. On the host: clone, `./install/install.sh`, fill in `secrets.env`, re-run.
diff --git a/targets.json b/targets.json
index f6c3a07..f634b69 100644
--- a/targets.json
+++ b/targets.json
@@ -28,11 +28,11 @@
   "hosts": {
     "s5.fisher.hu": {
       "bind": "10.255.255.1",
-      "port": 20090
+      "port": 21600
     },
     "s4.fisher.hu": {
       "bind": "10.255.255.12",
-      "port": 20090
+      "port": 21600
     }
   },