diff --git a/DEPLOY-NAS.md b/DEPLOY-NAS.md
index a9cfc45..5da9996 100644
--- a/DEPLOY-NAS.md
+++ b/DEPLOY-NAS.md
@@ -100,6 +100,54 @@ Then the NAS only needs to pull the image; no build on the NAS.
 
 ---
 
+## Option D: Pull from Gitea Container Registry (recommended)
+
+The repo’s Gitea Actions build the image and push it to the Gitea registry. Use this image on your NAS so you always run the latest build.
+
+**Image:** `brassnet.ddns.net:33983/Dawnsorrow/stoat-role-bot:latest`
+
+### On the NAS (so the image appears in your Docker app)
+
+1. **Add the registry as insecure (HTTP)**  
+   If your Gitea is HTTP (no HTTPS), Docker must allow this registry:
+   - In **UGOS Pro**: find Docker/Container settings (sometimes under “Registry” or “Docker daemon”) and add `brassnet.ddns.net:33983` to **insecure registries**.
+   - Or via SSH, edit Docker daemon config to include:
+     ```json
+     "insecure-registries": ["brassnet.ddns.net:33983"]
+     ```
+   - Restart Docker (or the NAS) if required.
+
+2. **Log in to the registry (so pull works)**  
+   - In the **Docker / App Center** UI: look for “Registry” or “Login” and add:
+     - Registry: `brassnet.ddns.net:33983`
+     - Username: your Gitea username (e.g. `Dawnsorrow`)
+     - Password: your Gitea password (or a token with package read)
+   - Or via SSH:
+     ```bash
+     docker login brassnet.ddns.net:33983
+     ```
+     Use your Gitea username and password when prompted.
+
+3. **Pull the image**  
+   - In the UI: use “Pull image” (or similar) and enter:
+     `brassnet.ddns.net:33983/Dawnsorrow/stoat-role-bot:latest`
+   - Or via SSH:
+     ```bash
+     docker pull brassnet.ddns.net:33983/Dawnsorrow/stoat-role-bot:latest
+     ```
+
+4. **Create and run the container**  
+   Same as Option B: create a container from the image above with:
+   - **Name**: e.g. `stoat-role-bot`
+   - **Restart**: Unless stopped
+   - **Environment**: `STOAT_BOT_TOKEN`, `PREFIX=!`, `CONFIG_PATH=/app/config`
+   - **Volume**: host folder with `roles.json` → `/app/config`
+
+5. **Updates**  
+   To get the newest version: pull again (`docker pull brassnet.ddns.net:33983/Dawnsorrow/stoat-role-bot:latest` or “Pull” in the UI), then recreate or restart the container.
+
+---
+
 ## Notes for UGREEN NAS
 
 - **Networking**: This bot only needs outbound HTTPS/WebSocket to Stoat/Revolt. No inbound ports or port mapping are required.