diff --git a/install/traefik/README.md b/install/traefik/README.md
new file mode 100644
index 0000000..eb788c9
--- /dev/null
+++ b/install/traefik/README.md
@@ -0,0 +1,27 @@
+# Railiance01 Traefik upload timeout
+
+Forgejo OCI blob uploads were cut off at 60 seconds with unexpected EOF and
+HTTP 499/500. The shared HTTPS entry point now declares a bounded 600-second
+request-read budget via the k3s-managed HelmChartConfig. It applies to all
+websecure request bodies; it does not disable timeouts or change authentication.
+
+Validated against the installed chart traefik-38.0.201+up38.0.2 and its live
+values: the rendered difference is exactly one additional argument. Traefik
+remains 3.6.7. The separate HelmChartConfig survives k3s reconciliation; do not
+edit the generated Deployment or packaged traefik.yaml.
+
+After node/capacity review, run from this repository:
+
+```sh
+ssh railiance01 'kubectl apply --server-side --dry-run=server -f -' < install/traefik/railiance01-helmchartconfig.yaml
+ssh railiance01 'kubectl diff -f -' < install/traefik/railiance01-helmchartconfig.yaml
+ssh railiance01 'kubectl apply --server-side -f -' < install/traefik/railiance01-helmchartconfig.yaml
+```
+
+Wait for the Helm controller to finish and the replacement Traefik pod to become
+Ready. Verify the actual argument, HTTPS endpoints and a previously failing
+large OCI publication. Rollback: set the argument to 60s in this source and
+reapply with the same checks; this restores the former upload limitation.
+
+References: [Traefik read timeout](https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/)
+and [k3s customization](https://docs.k3s.io/networking/networking-services).
diff --git a/install/traefik/railiance01-helmchartconfig.yaml b/install/traefik/railiance01-helmchartconfig.yaml
new file mode 100644
index 0000000..ada1efe
--- /dev/null
+++ b/install/traefik/railiance01-helmchartconfig.yaml
@@ -0,0 +1,9 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    additionalArguments:
+      - "--entryPoints.websecure.transport.respondingTimeouts.readTimeout=600s"
diff --git a/workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md b/workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md
new file mode 100644
index 0000000..d1049c1
--- /dev/null
+++ b/workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md
@@ -0,0 +1,43 @@
+---
+id: RCLUSTER-WP-0016
+type: workplan
+title: Fix the ingress timeout interrupting Forgejo OCI uploads
+domain: financials
+repo: railiance-cluster
+topic_slug: railiance
+status: active
+flavor: implementation
+owner: codex
+created: "2026-10-13"
+updated: "2026-10-13"
+---
+
+# Forgejo upload timeout
+
+The founder requested fixing rapp-playwright image publication on 2026-10-13.
+Large authenticated blob PUTs fail after 59998-60001ms with unexpected EOF.
+Traefik 3.6.7 has the default 60s read timeout; Forgejo is healthy and has disk
+headroom. Source/configuration ownership is S2 railiance-cluster.
+
+## Apply the managed timeout and prove image publication
+
+```task
+id: RCLUSTER-WP-0016-T01
+status: progress
+priority: high
+```
+
+Change only the shared websecure request-read timeout to 600s through a retained
+HelmChartConfig. Record ADMINISTER @ realm:kubernetes/railiance01,
+activation=APPROVED under the founder's scoped publication-fix instruction and
+approval of this concrete shared-ingress change. Use the existing k3s Helm
+controller; no ArgoCD application exists for this packaged component. Before
+apply, retain the one-argument rendered diff, server dry-run and capacity check.
+After apply, verify the controller rollout, stable HTTPS/authentication, real
+large blob upload, remote manifest digest and image pull. Revert the source
+argument to 60s if rollout health fails. Record the longer request-body allowance
+on the estate close-down checklist. No endpoint, TLS or identity policy changes.
+
+Acceptance is runtime evidence and successful immutable publication; do not
+finish merely because the manifest was accepted. Evidence lives with the
+rapp-playwright publication report and a cluster execution receipt.