diff --git a/services/gitea.sh b/services/gitea.sh
index 6ec19c2..b573dc8 100644
--- a/services/gitea.sh
+++ b/services/gitea.sh
@@ -1065,17 +1065,52 @@ picked up next interval anyway).
 
 Not set up yet, or want to change the port/secret? Re-run
 \`sudo ./setup.sh gitea\` (Update mode is fine) and answer yes to "Also add
-a GitHub webhook...". Once it's running, add the webhook itself on GitHub:
-repo -> Settings -> Webhooks -> Add webhook, Content type
-\`application/json\`, event \`Just the push event\`, using the payload
-URL/secret the installer printed (also in \`.env\` as \`WEBHOOK_PORT\` /
-\`WEBHOOK_SECRET\` if you need them again).
+a GitHub webhook...". That only stands up the *receiver* on this box — you
+still add the actual webhook on GitHub's side afterward, using the payload
+URL and secret the installer printed (also readable back from \`.env\` as
+\`WEBHOOK_PORT\` / \`WEBHOOK_SECRET\` if you need them again).
+
+**Option A — one repo at a time.** Fastest, but only covers repos you do
+this for individually:
+repo -> Settings -> Webhooks -> Add webhook
+- Payload URL: the URL the installer printed
+- Content type: \`application/json\`
+- Secret: your \`WEBHOOK_SECRET\`
+- Events: "Just the push event"
+
+**Option B — every repo on your account, current AND future, from one
+setup.** A plain repo webhook (Option A) is always per-repo, no way around
+that — but a personal GitHub App installed with "All repositories" access
+covers every repo automatically, including ones you create afterward. No
+receiver/code change needed for this: an App's webhook uses the exact same
+HMAC-secret mechanism as a repo webhook, so the same \`WEBHOOK_SECRET\`
+works for both.
+
+1. GitHub -> Settings -> Developer settings -> GitHub Apps -> New GitHub App
+2. Webhook URL: same payload URL as Option A. Webhook secret: your
+   \`WEBHOOK_SECRET\`. (Homepage URL is a separate, purely cosmetic field —
+   point it at anything, e.g. your GitHub profile; GitHub never sends
+   anything there, unlike Webhook URL.)
+3. Permissions -> Repository permissions -> Contents: Read-only (required
+   to unlock the Push event checkbox)
+4. Subscribe to events: Push only
+5. Where can this GitHub App be installed: "Only on this account"
+6. Create it, then Install App -> choose "All repositories" -> Install
+
+If you'd already added Option A webhooks on a few repos, they're now
+redundant (not harmful, just two triggers per push) — remove them once
+the App is confirmed working.
+
+**Verify either option** — push to a repo, then watch it arrive:
 
 \`\`\`bash
 systemctl status gitea-github-webhook   # is it running?
 journalctl -u gitea-github-webhook -f   # watch it receive + trigger syncs
 \`\`\`
 
+GitHub also shows delivery attempts and response codes: repo (or App) ->
+Settings -> Webhooks -> the webhook -> Recent Deliveries.
+
 ## Sign in with Authelia (optional)
 
 If Authelia is installed, re-run \`sudo ./setup.sh gitea\` (Update mode is