diff --git a/.github/workflows/plugin.yml b/.github/workflows/plugin.yml
index 27a9158..640bad1 100644
--- a/.github/workflows/plugin.yml
+++ b/.github/workflows/plugin.yml
@@ -1,5 +1,5 @@
 # Execution stays disabled until the operator records Blacksmith qualification.
-# See webdock/tools/plugin-ci/BLACKSMITH.md; runner labels alone do not select a region.
+# See https://github.com/spitzli/cloud/blob/main/tools/plugin-ci/BLACKSMITH.md; runner labels alone do not select a region.
 # Copy to .github/workflows/plugin.yml in each independent native plugin repository.
 name: Native plugin
 on:
@@ -16,17 +16,17 @@ concurrency:
 
 jobs:
   check:
-    if: vars.WEBDOCK_BLACKSMITH_READY == 'true' && vars.WEBDOCK_BLACKSMITH_REGION != '' && vars.WEBDOCK_BLACKSMITH_BUILDER_READY == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    if: vars.SPITZLI_BLACKSMITH_READY == 'true' && vars.SPITZLI_BLACKSMITH_REGION != '' && vars.SPITZLI_BLACKSMITH_BUILDER_READY == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     env:
-      WEBDOCK_OCI_BACKEND: blacksmith-buildx
-      WEBDOCK_BLACKSMITH_REGION: ${{ vars.WEBDOCK_BLACKSMITH_REGION }}
+      SPITZLI_OCI_BACKEND: blacksmith-buildx
+      SPITZLI_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
     steps:
       - name: Require reviewed Blacksmith execution
         shell: bash
         env:
-          QUALIFIED_BLACKSMITH_REGION: ${{ vars.WEBDOCK_BLACKSMITH_REGION }}
+          QUALIFIED_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
         run: |
           set -euo pipefail
           case "${BLACKSMITH_REGION:-}" in us-east|us-west|eu-central|eu-west) ;; *) echo 'Recorded Blacksmith region required' >&2; exit 1 ;; esac
@@ -78,7 +78,7 @@ jobs:
 
   release:
     needs: check
-    if: vars.WEBDOCK_BLACKSMITH_READY == 'true' && vars.WEBDOCK_BLACKSMITH_REGION != '' && vars.WEBDOCK_BLACKSMITH_BUILDER_READY == 'true' && (startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push')
+    if: vars.SPITZLI_BLACKSMITH_READY == 'true' && vars.SPITZLI_BLACKSMITH_REGION != '' && vars.SPITZLI_BLACKSMITH_BUILDER_READY == 'true' && (startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push')
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     # Restrict this environment to release tags using the repository's tag policy.
@@ -87,13 +87,13 @@ jobs:
       contents: write
       packages: write
     env:
-      WEBDOCK_OCI_BACKEND: blacksmith-buildx
-      WEBDOCK_BLACKSMITH_REGION: ${{ vars.WEBDOCK_BLACKSMITH_REGION }}
+      SPITZLI_OCI_BACKEND: blacksmith-buildx
+      SPITZLI_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
     steps:
       - name: Require reviewed Blacksmith execution
         shell: bash
         env:
-          QUALIFIED_BLACKSMITH_REGION: ${{ vars.WEBDOCK_BLACKSMITH_REGION }}
+          QUALIFIED_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
         run: |
           set -euo pipefail
           case "${BLACKSMITH_REGION:-}" in us-east|us-west|eu-central|eu-west) ;; *) echo 'Recorded Blacksmith region required' >&2; exit 1 ;; esac
@@ -168,7 +168,7 @@ jobs:
             --verify-tag --title "$GITHUB_REF_NAME" --generate-notes "${prerelease[@]}"
   registry:
     needs: release
-    if: vars.WEBDOCK_BLACKSMITH_READY == 'true' && vars.WEBDOCK_BLACKSMITH_REGION != '' && (startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push')
+    if: vars.SPITZLI_BLACKSMITH_READY == 'true' && vars.SPITZLI_BLACKSMITH_REGION != '' && (startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push')
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     environment: plugin-release
@@ -178,7 +178,7 @@ jobs:
       - name: Require reviewed Blacksmith execution
         shell: bash
         env:
-          QUALIFIED_BLACKSMITH_REGION: ${{ vars.WEBDOCK_BLACKSMITH_REGION }}
+          QUALIFIED_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
         run: |
           set -euo pipefail
           case "${BLACKSMITH_REGION:-}" in us-east|us-west|eu-central|eu-west) ;; *) echo 'Recorded Blacksmith region required' >&2; exit 1 ;; esac
diff --git a/scripts/plugin-release/build_oci.py b/scripts/plugin-release/build_oci.py
index 813c861..ce215fc 100644
--- a/scripts/plugin-release/build_oci.py
+++ b/scripts/plugin-release/build_oci.py
@@ -87,7 +87,7 @@ def qualified_buildctl(config):
     require(executable, 'Preinstalled qualified buildctl required')
     path = Path(executable).resolve()
     info = path.stat()
-    expected = config.get('WEBDOCK_BUILDCTL_SHA256', '')
+    expected = config.get('SPITZLI_BUILDCTL_SHA256', '')
     require(re.fullmatch(r'[a-f0-9]{64}', expected) and stat.S_ISREG(info.st_mode)
             and info.st_uid in {0, os.getuid()} and info.st_mode & 0o022 == 0,
             'Pinned operator-qualified buildctl binary required')
@@ -108,7 +108,7 @@ def selected_dockerfile(context, value='Dockerfile'):
 def require_blacksmith_region(config):
     region = config.get('BLACKSMITH_REGION', '')
     require(config.get('GITHUB_ACTIONS') == 'true' and region in {'us-east', 'us-west', 'eu-central', 'eu-west'}
-            and region == config.get('WEBDOCK_BLACKSMITH_REGION'), 'Actual Blacksmith job and matching recorded region required')
+            and region == config.get('SPITZLI_BLACKSMITH_REGION'), 'Actual Blacksmith job and matching recorded region required')
 
 
 def require_fresh_blacksmith_builder(config):
@@ -148,7 +148,7 @@ def build_image(context, temporary_root, config, token, check=False, bootstrap=F
     temporary_root = Path(temporary_root).resolve()
     require(not temporary_root.is_relative_to(context), 'Private runner temporary files must remain outside the build context')
     require(not (check and bootstrap), 'Select one build target')
-    dockerfile = selected_dockerfile(context, 'deploy/docker/backend.Dockerfile' if bootstrap else config.get('WEBDOCK_PLUGIN_DOCKERFILE', 'Dockerfile'))
+    dockerfile = selected_dockerfile(context, 'deploy/docker/backend.Dockerfile' if bootstrap else config.get('SPITZLI_PLUGIN_DOCKERFILE', 'Dockerfile'))
     archive = temporary_root / 'webdock-backend.oci.tar'
     if bootstrap:
         require(not archive.exists() and not archive.is_symlink(), 'Bootstrap archive must not already exist')
@@ -160,13 +160,13 @@ def build_image(context, temporary_root, config, token, check=False, bootstrap=F
     require(re.fullmatch(r'[a-f0-9]{40}', revision), 'Exact source revision required')
     require(re.fullmatch(r'[A-Za-z0-9_-]+(?:\[bot\])?', actor), 'GitHub actor required')
     require(isinstance(token, str) and (token == '' if check or bootstrap else re.fullmatch(r'[A-Za-z0-9_.-]{10,2048}', token)), 'Publishing token required only for the production image push')
-    backend = config.get('WEBDOCK_OCI_BACKEND', 'rootless-buildctl')
+    backend = config.get('SPITZLI_OCI_BACKEND', 'rootless-buildctl')
     require(backend in {'rootless-buildctl', 'blacksmith-buildx'}, 'Explicit supported OCI backend required')
     if backend == 'blacksmith-buildx':
         docker, builder, provider_config = qualified_blacksmith_builder(config)
         require(not Path(provider_config).is_relative_to(context), 'Provider builder state must stay outside the source context')
     else:
-        address = config.get('WEBDOCK_BUILDKIT_ADDR', '')
+        address = config.get('SPITZLI_BUILDKIT_ADDR', '')
         validate_socket(address)
         buildctl = qualified_buildctl(config)
     with tempfile.TemporaryDirectory(prefix='plugin-build-', dir=temporary_root) as temporary: