diff --git a/ansible/roles/gitea/templates/docker-compose.yml.j2 b/ansible/roles/gitea/templates/docker-compose.yml.j2
index ad609c8..493b4c9 100644
--- a/ansible/roles/gitea/templates/docker-compose.yml.j2
+++ b/ansible/roles/gitea/templates/docker-compose.yml.j2
@@ -41,7 +41,6 @@ services:
       - "traefik.http.routers.gitea.entrypoints=websecure"
       - "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
-      - "traefik.http.routers.gitea.middlewares=rate-limit@docker"
     depends_on:
       gitea-db:
         condition: service_healthy
diff --git a/ansible/roles/registry/templates/docker-compose.yml.j2 b/ansible/roles/registry/templates/docker-compose.yml.j2
index 7a565f8..6d617fc 100644
--- a/ansible/roles/registry/templates/docker-compose.yml.j2
+++ b/ansible/roles/registry/templates/docker-compose.yml.j2
@@ -20,9 +20,6 @@ services:
       - "traefik.http.routers.registry.entrypoints=websecure"
       - "traefik.http.routers.registry.tls.certresolver=letsencrypt"
       - "traefik.http.services.registry.loadbalancer.server.port=5000"
-      - "traefik.http.routers.registry.middlewares=registry-buffering"
-      # Remove body size limit so large image layers can be pushed
-      - "traefik.http.middlewares.registry-buffering.buffering.maxRequestBodyBytes=0"
 
 networks:
   traefik_public:
diff --git a/ansible/roles/traefik/templates/traefik.yml.j2 b/ansible/roles/traefik/templates/traefik.yml.j2
index 2dc1aa9..10e7efb 100644
--- a/ansible/roles/traefik/templates/traefik.yml.j2
+++ b/ansible/roles/traefik/templates/traefik.yml.j2
@@ -24,6 +24,9 @@ entryPoints:
           permanent: true
   websecure:
     address: ":443"
+    transport:
+      respondingTimeouts:
+        readTimeout: 0    # no limit — required for large registry layer uploads
   imaps:
     address: ":993"