diff --git a/k8s/apps/gitea/deployment.yaml b/k8s/apps/gitea/deployment.yaml
index 35ec810..3b00b8c 100644
--- a/k8s/apps/gitea/deployment.yaml
+++ b/k8s/apps/gitea/deployment.yaml
@@ -41,13 +41,13 @@ spec:
             - name: GITEA__service__REGISTER_MANUAL_CONFIRM
               value: "true"
             - name: GITEA__service__ENABLE_CAPTCHA
-              value: "false"
-            - name: GITEA__service__REQUIRE_CAPTCHA_FOR_LOGIN
               value: "true"
+            - name: GITEA__service__REQUIRE_CAPTCHA_FOR_LOGIN
+              value: "false"
             - name: GITEA__service__REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA
               value: "true"
             - name: GITEA__service__CAPTCHA_TYPE
-              value: "hcaptcha"
+              value: "cfturnstile"
             - name: GITEA__webhook__ALLOWED_HOST_LIST
               value: "*"
           envFrom:
diff --git a/k8s/apps/gitea/external-secrets.yaml b/k8s/apps/gitea/external-secrets.yaml
index d9d009d..60c4514 100644
--- a/k8s/apps/gitea/external-secrets.yaml
+++ b/k8s/apps/gitea/external-secrets.yaml
@@ -40,6 +40,10 @@ spec:
           {{ .HCAPTCHA_SITEKEY }}
         GITEA__service__HCAPTCHA_SECRET: |-
           {{ .HCAPTCHA_SECRET }}
+        GITEA__service__CF_TURNSTILE_SITEKEY: |-
+          {{ .CF_TURNSTILE_SITEKEY }}
+        GITEA__service__CF_TURNSTILE_SECRET: |-
+          {{ .CF_TURNSTILE_SECRET }}
   data:
     - secretKey: HCAPTCHA_SITEKEY
       sourceRef: