diff --git a/sim/cluster0/gitea/app.ini.template b/sim/cluster0/gitea/app.ini.template
index 2ad6daa..de8e6a0 100644
--- a/sim/cluster0/gitea/app.ini.template
+++ b/sim/cluster0/gitea/app.ini.template
@@ -43,7 +43,12 @@ LEVEL = info
 PATH = @GITEA_APP_DATA@/lfs
 
 [mailer]
-ENABLED = false
+ENABLED = true
+PROTOCOL = sendmail
+FROM = Android Cast Lab <@MSMTP_FROM@>
+SENDMAIL_PATH = /usr/sbin/sendmail
+SENDMAIL_ARGS = --
+SUBJECT_PREFIX = [AndroidCast Gitea]
 
 [service]
 REGISTER_EMAIL_CONFIRM = false
diff --git a/sim/cluster0/lab-seeds/backend/scripts/gitea/gitea_protect_branches.sh b/sim/cluster0/lab-seeds/backend/scripts/gitea/gitea_protect_branches.sh
index 7ddd044..b016f07 100755
--- a/sim/cluster0/lab-seeds/backend/scripts/gitea/gitea_protect_branches.sh
+++ b/sim/cluster0/lab-seeds/backend/scripts/gitea/gitea_protect_branches.sh
@@ -73,7 +73,9 @@ gitea_protect_payload() {
   "push_whitelist_teams": ["$GITEA_PROTECT_PUSH_TEAM"],
   "enable_force_push": false,
   "enable_force_push_allowlist": false,
-  "block_admin_merge_override": true
+  "block_admin_merge_override": true,
+  "enable_status_check": true,
+  "status_check_contexts": ["androidcast/build"]
 }
 EOF
 }
diff --git a/sim/cluster0/scripts/configure-php-fpm.sh b/sim/cluster0/scripts/configure-php-fpm.sh
index dd08d37..41962d0 100644
--- a/sim/cluster0/scripts/configure-php-fpm.sh
+++ b/sim/cluster0/scripts/configure-php-fpm.sh
@@ -11,3 +11,22 @@ grep -q '^listen = 127.0.0.1:9000' "$CONF" 2>/dev/null || \
 grep -q '^listen.allowed_clients' "$CONF" 2>/dev/null || \
   printf '\nlisten.allowed_clients = 127.0.0.1\n' >> "$CONF"
 log "php-fpm83 listen 127.0.0.1:9000"
+
+PHP_INI=/etc/php83/php.ini
+if [ -f "$PHP_INI" ]; then
+  for pair in \
+    'upload_max_filesize=16M' \
+    'post_max_size=20M'
+  do
+    key="${pair%%=*}"
+    val="${pair#*=}"
+    if grep -q "^${key} =" "$PHP_INI" 2>/dev/null; then
+      sed -i "s|^${key} = .*|${key} = ${val}|" "$PHP_INI"
+    elif grep -q "^;${key} =" "$PHP_INI" 2>/dev/null; then
+      sed -i "s|^;${key} = .*|${key} = ${val}|" "$PHP_INI"
+    else
+      printf '\n%s = %s\n' "$key" "$val" >> "$PHP_INI"
+    fi
+  done
+  log "php83 upload limits upload_max_filesize=16M post_max_size=20M"
+fi
diff --git a/sim/cluster0/scripts/deploy-gitea.sh b/sim/cluster0/scripts/deploy-gitea.sh
index f3f574f..2aaf16b 100755
--- a/sim/cluster0/scripts/deploy-gitea.sh
+++ b/sim/cluster0/scripts/deploy-gitea.sh
@@ -90,6 +90,10 @@ fi
 if [ ! -f "$INI" ] || [ "${FORCE_GITEA_CONFIG:-0}" = "1" ] || ! grep -q 'AndroidCast lab' "$INI" 2>/dev/null; then
   log "render $INI from template (ROOT_URL=$GITEA_ROOT_URL)"
   _tmp="$(mktemp)"
+  _msmtp_from="${MSMTP_FROM:-bestcastr@gmail.com}"
+  _msmtp_user="${MSMTP_USER:-bestcastr@gmail.com}"
+  _msmtp_pass="$(read_secret MSMTP_APP_PASSWORD 2>/dev/null || true)"
+  [ -n "$_msmtp_pass" ] || _msmtp_pass="${MSMTP_APP_PASSWORD:-}"
   sed \
     -e "s|@GITEA_APP_DATA@|${GITEA_APP_DATA}|g" \
     -e "s|@GITEA_DOMAIN@|${GITEA_DOMAIN}|g" \
@@ -98,6 +102,9 @@ if [ ! -f "$INI" ] || [ "${FORCE_GITEA_CONFIG:-0}" = "1" ] || ! grep -q 'Android
     -e "s|@GITEA_INTERNAL_TOKEN@|${GITEA_INTERNAL_TOKEN}|g" \
     -e "s|@GITEA_OAUTH_JWT@|${GITEA_OAUTH_JWT}|g" \
     -e "s|@GITEA_LFS_JWT@|${GITEA_LFS_JWT}|g" \
+    -e "s|@MSMTP_FROM@|${_msmtp_from}|g" \
+    -e "s|@MSMTP_USER@|${_msmtp_user}|g" \
+    -e "s|@MSMTP_PASS@|${_msmtp_pass}|g" \
     "$TEMPLATE" > "$_tmp"
   install -m 640 -o gitea -g www-data "$_tmp" "$INI"
   rm -f "$_tmp"