diff --git a/Dockerfile b/Dockerfile
index cec47b4..8810bbc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -201,19 +201,16 @@ WORKDIR /root
 LABEL maintainer="CasjaysDev <docker-admin@casjaysdev.pro>"
 LABEL org.opencontainers.image.vendor="CasjaysDev"
 LABEL org.opencontainers.image.authors="CasjaysDev"
-LABEL org.opencontainers.image.description="Containerized version of ${IMAGE_NAME}"
+LABEL org.opencontainers.image.licenses="${LICENSE}"
 LABEL org.opencontainers.image.title="${IMAGE_NAME}"
-LABEL org.opencontainers.image.base.name="${IMAGE_NAME}"
-LABEL org.opencontainers.image.authors="${LICENSE}"
+LABEL org.opencontainers.image.description="Containerized version of ${IMAGE_NAME}"
 LABEL org.opencontainers.image.created="${BUILD_DATE}"
 LABEL org.opencontainers.image.version="${BUILD_VERSION}"
-LABEL org.opencontainers.image.schema-version="${BUILD_VERSION}"
-LABEL org.opencontainers.image.url="https://docker.io/casjaysdevdocker/gitea"
-LABEL org.opencontainers.image.source="https://docker.io/casjaysdevdocker/gitea"
-LABEL org.opencontainers.image.vcs-type="Git"
 LABEL org.opencontainers.image.revision="${GIT_COMMIT}"
+LABEL org.opencontainers.image.url="https://docker.io/casjaysdevdocker/gitea"
 LABEL org.opencontainers.image.source="https://github.com/casjaysdevdocker/gitea"
 LABEL org.opencontainers.image.documentation="https://github.com/casjaysdevdocker/gitea"
+LABEL org.opencontainers.image.vcs-type="Git"
 LABEL com.github.containers.toolbox="false"
 
 ENV ENV=~/.bashrc
diff --git a/TODO.AI.md b/TODO.AI.md
index 05da4f9..b47d1af 100644
--- a/TODO.AI.md
+++ b/TODO.AI.md
@@ -70,7 +70,15 @@ Needs syncing back to the upstream template per AI.md's runbook.
   lines (~line 241) in `rootfs/usr/local/bin/entrypoint.sh`. Needs syncing to the upstream
   template per AI.md's runbook.
 
+## OCI label cleanup done — forbidden labels removed from Dockerfile
+
+- Removed `org.opencontainers.image.base.name` (belongs on the base image, not the app image) and
+  `org.opencontainers.image.schema-version` (non-spec, redundant with `version`).
+- Removed the duplicate `org.opencontainers.image.authors="${LICENSE}"` line and duplicate
+  `org.opencontainers.image.source="https://docker.io/..."` line; the license value now correctly
+  populates the (previously missing) `org.opencontainers.image.licenses` label per AI.md's OCI
+  label standard (lines 58-87), and `source` keeps the single github.com URL.
+
 ## Other observations not yet actioned
 
 - `.gitea/workflows/docker.yaml` uses the same stale/unpinned action pattern (`@v2`-`@v4`, DockerHub-only, `catthehacker/ubuntu:act-latest`) that was removed from the `opengist` repo's duplicate workflow — no `build.yml` counterpart exists here yet.
-- `Dockerfile` sets forbidden OCI labels (`org.opencontainers.image.base.name`, `.schema-version`, duplicate `authors`) — same issue previously found and fixed in `opengist`.