diff --git a/src/fable5/agent-teams.ts b/src/fable5/agent-teams.ts
index c4713b6..dd38535 100644
--- a/src/fable5/agent-teams.ts
+++ b/src/fable5/agent-teams.ts
@@ -77,7 +77,7 @@ const WORKER_ROLES: Array<{ name: string; prompt: string; domainLock: string; ti
   {
     name: "devops",
     prompt: "You are the DevOps Engineer. Own CI/CD configs, deployment scripts, infrastructure code. Never modify application code.",
-    domainLock: ".github/",
+    domainLock: ".forgejo/",
     tier: "haiku",
   },
 ];
diff --git a/src/fable5/forgejo-intake.test.ts b/src/fable5/forgejo-intake.test.ts
index 887a8ec..638b3cc 100644
--- a/src/fable5/forgejo-intake.test.ts
+++ b/src/fable5/forgejo-intake.test.ts
@@ -29,8 +29,11 @@ describe("forgejo intake", () => {
   it("routes labels without LLM classification", () => {
     expect(routeForgejoLabels(["seo"])).toBe("seo");
     expect(routeForgejoLabels(["domain/sec"])).toBe("security");
+    expect(routeForgejoLabels(["sales"])).toBe("sales-marketing");
     expect(routeForgejoLabels(["client", "bug"])).toBe("client-report");
+    expect(routeForgejoLabels(["feedbackpilot"])).toBe("user-feedback");
     expect(routeForgejoLabels(["pipeline"])).toBe("data-pipeline");
+    expect(routeForgejoLabels(["infra"])).toBe("devops");
     expect(routeForgejoLabels(["unknown"])).toBe("triage");
   });
 
diff --git a/src/fable5/forgejo-intake.ts b/src/fable5/forgejo-intake.ts
index 49fd93e..8a9be4a 100644
--- a/src/fable5/forgejo-intake.ts
+++ b/src/fable5/forgejo-intake.ts
@@ -4,7 +4,7 @@ import { findPromptInjection, type PromptInjectionFinding } from "../core/prompt
 import { emitChannelEvent } from "./channel.js";
 
 export type ForgejoIntakeKind = "issue" | "pull" | "wiki";
-export type ForgejoRoute = "security" | "seo" | "client-report" | "data-pipeline" | "dev" | "wiki" | "triage" | "human-review";
+export type ForgejoRoute = "security" | "seo" | "sales-marketing" | "client-report" | "user-feedback" | "data-pipeline" | "devops" | "dev" | "wiki" | "triage" | "human-review";
 
 export interface ForgejoIntakeSource {
   type: `forgejo_${ForgejoIntakeKind}`;
@@ -66,10 +66,13 @@ type ForgejoApiItem = {
 
 export function routeForgejoLabels(labels: string[]): ForgejoRoute {
   const normalized = labels.map((label) => label.toLowerCase());
-  if (hasAny(normalized, ["security", "sec"])) return "security";
+  if (hasAny(normalized, ["security", "sec", "sec-first"])) return "security";
   if (hasAny(normalized, ["seo"])) return "seo";
+  if (hasAny(normalized, ["sales", "marketing", "sale-marketing", "sales-marketing"])) return "sales-marketing";
   if (hasAny(normalized, ["client", "report", "client-report"])) return "client-report";
+  if (hasAny(normalized, ["user", "users", "feedback", "feedbackpilot", "user-feedback"])) return "user-feedback";
   if (hasAny(normalized, ["data", "pipeline", "data-pipeline"])) return "data-pipeline";
+  if (hasAny(normalized, ["devops", "ops", "infra", "ci", "cd"])) return "devops";
   if (hasAny(normalized, ["dev", "bug", "feature"])) return "dev";
   if (hasAny(normalized, ["wiki", "docs"])) return "wiki";
   return "triage";
diff --git a/src/fable5/meta-agent.ts b/src/fable5/meta-agent.ts
index b9f6d57..ced80f8 100644
--- a/src/fable5/meta-agent.ts
+++ b/src/fable5/meta-agent.ts
@@ -30,7 +30,7 @@ const AGENT_TEMPLATES: Record<string, { role: string; tools: string[]; domainLoc
   reviewer: { role: "Review code for correctness, security, style, test coverage", tools: ["read", "grep", "glob"], domainLock: "read-only" },
   tester: { role: "Write and run tests, verify edge cases", tools: ["read", "write", "edit", "bash"], domainLock: "tests/" },
   documenter: { role: "Write documentation, README updates, inline comments", tools: ["read", "write"], domainLock: "docs/" },
-  devops: { role: "Manage CI/CD, deployment config, infrastructure", tools: ["read", "write", "bash"], domainLock: ".github/" },
+  devops: { role: "Manage CI/CD, deployment config, infrastructure", tools: ["read", "write", "bash"], domainLock: ".forgejo/" },
   security: { role: "Audit for vulnerabilities, OWASP, dependency risks", tools: ["read", "grep"], domainLock: "read-only" },
 };