diff --git a/docs/getting-started/first-server.md b/docs/getting-started/first-server.md
index 00d1f16..b8e691c 100644
--- a/docs/getting-started/first-server.md
+++ b/docs/getting-started/first-server.md
@@ -89,7 +89,7 @@ Open the server's page. Within a minute or two you should see:
 | ------------------------------------------ | ------------------------------------------------------------------------------------------------------ |
 | Script stops at "Unsupported architecture" | The machine is not 64-bit x86 or ARM                                                                    |
 | "Checksum mismatch!"                       | An interrupted download, or a proxy rewriting the response. Run it again                                |
-| "Could not determine latest agent version" | The machine cannot reach the release host, or `GITEA_HOST` is not set on your control plane             |
+| "Could not determine latest agent version" | The machine cannot reach the release host, `gitea.hostxtra.co.uk`                                      |
 | Service runs, server stays `pending`       | The machine cannot reach the agent port. Test it from that machine, not from the control plane          |
 | Registers, then goes `offline`             | A firewall or proxy allows the first connection but drops the long-lived one                            |
 | "Server limit reached"                     | Your licence allowance is full. Raise it in Vantage HQ, or remove a server you no longer manage         |
diff --git a/docs/getting-started/self-hosted-install.md b/docs/getting-started/self-hosted-install.md
index a46297c..b339bcf 100644
--- a/docs/getting-started/self-hosted-install.md
+++ b/docs/getting-started/self-hosted-install.md
@@ -48,9 +48,6 @@ GRPC_HOST=vantage.example.com:9090
 # 32 bytes as 64 hex characters. Generate it with the command below.
 KEY_ENCRYPTION_KEY=
 
-# The host serving agent downloads.
-GITEA_HOST=gitea.hostxtra.co.uk
-
 # Optional: host port for the bundled nginx proxy. Defaults to 80.
 # NGINX_HTTP_PORT=80
 ```
@@ -61,16 +58,6 @@ Generate the encryption key:
 openssl rand -hex 32
 ```
 
-Then make sure the `server` service passes `GITEA_HOST` through, by adding this
-line to its `environment:` block in `docker-compose.yml`:
-
-```yaml
-GITEA_HOST: ${GITEA_HOST}
-```
-
-Without it, the install command you hand to a new server cannot work out which
-agent to download.
-
 :::danger Keep the encryption key safe
 `KEY_ENCRYPTION_KEY` encrypts SSH private keys, vault secrets, single sign-on
 client secrets and console credentials. If you lose it, all of those become
diff --git a/docs/reference/environment-variables.md b/docs/reference/environment-variables.md
index 6e2eac7..d7fe097 100644
--- a/docs/reference/environment-variables.md
+++ b/docs/reference/environment-variables.md
@@ -17,7 +17,6 @@ it is absent.
 | `REDIS_USERNAME`           | no              |                             | Redis 6+ ACL user. Leave empty against a legacy `requirepass` instance, which authenticates with the password alone                                                |
 | `REDIS_PASSWORD`           | no              |                             | Leave empty for an unauthenticated Redis. Both of these exist so an install can use a managed Redis rather than the bundled one                                    |
 | `KEY_ENCRYPTION_KEY`       | yes in practice |                             | 64 hex characters (32 bytes) for AES-256-GCM. Required for private keys, vault secrets, OIDC client secrets and console credentials                                |
-| `GITEA_HOST`               | yes in practice | `gitea.example.com`         | Host serving agent releases; used to build the install scripts and download URLs. The default is a placeholder that will not resolve, so set it to `gitea.hostxtra.co.uk` |
 | `GUACD_ADDR`               | no              | `guacd:4822`                | The [browser console](../vantage/browser-console.md) daemon                                                                                                        |
 | `PROXY_ADVERTISE_HOST`     | no              | `server`                    | The hostname **guacd** uses to reach the control plane's console relay. Wrong here and every console session fails at connect with guacd unable to resolve the relay |
 | `PROXY_LISTEN_HOST`        | no              | `0.0.0.0`                   | Interface the ephemeral relay listeners bind. Narrow it only if guacd shares a known interface                                                                     |