diff --git a/internal/cmd/setup/cmd_github.go b/internal/cmd/setup/cmd_github.go
index 065a928c..5eda47b2 100644
--- a/internal/cmd/setup/cmd_github.go
+++ b/internal/cmd/setup/cmd_github.go
@@ -25,7 +25,6 @@ import (
 	"github.com/host-uk/core/pkg/cli"
 	"github.com/host-uk/core/pkg/i18n"
 	coreio "github.com/host-uk/core/pkg/io"
-	"github.com/host-uk/core/pkg/log"
 	"github.com/host-uk/core/pkg/repos"
 	"github.com/spf13/cobra"
 )
@@ -76,7 +75,6 @@ func runGitHubSetup() error {
 
 	// Check gh is authenticated
 	if !cli.GhAuthenticated() {
-		cli.LogSecurity("GitHub setup failed: not authenticated", "action", "setup github", "user", log.Username())
 		return errors.New(i18n.T("cmd.setup.github.error.not_authenticated"))
 	}
 
diff --git a/pkg/repos/registry.go b/pkg/repos/registry.go
index 57f9be85..620585dd 100644
--- a/pkg/repos/registry.go
+++ b/pkg/repos/registry.go
@@ -20,6 +20,7 @@ type Registry struct {
 	BasePath string           `yaml:"base_path"`
 	Repos    map[string]*Repo `yaml:"repos"`
 	Defaults RegistryDefaults `yaml:"defaults"`
+	medium   io.Medium        `yaml:"-"`
 }
 
 // RegistryDefaults contains default values applied to all repos.
@@ -56,21 +57,26 @@ type Repo struct {
 	Clone       *bool    `yaml:"clone,omitempty"` // nil = true, false = skip cloning
 
 	// Computed fields
-	Path string `yaml:"-"` // Full path to repo directory
+	Path     string    `yaml:"-"` // Full path to repo directory
+	registry *Registry `yaml:"-"`
 }
 
-// LoadRegistry reads and parses a repos.yaml file.
-func LoadRegistry(path string) (*Registry, error) {
-	dataStr, err := io.Local.Read(path)
+// LoadRegistry reads and parses a repos.yaml file from the given medium.
+// The path should be a valid path for the provided medium.
+func LoadRegistry(m io.Medium, path string) (*Registry, error) {
+	content, err := m.Read(path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read registry file: %w", err)
 	}
+	data := []byte(content)
 
 	var reg Registry
-	if err := yaml.Unmarshal([]byte(dataStr), &reg); err != nil {
+	if err := yaml.Unmarshal(data, &reg); err != nil {
 		return nil, fmt.Errorf("failed to parse registry file: %w", err)
 	}
 
+	reg.medium = m
+
 	// Expand base path
 	reg.BasePath = expandPath(reg.BasePath)
 
@@ -78,6 +84,7 @@ func LoadRegistry(path string) (*Registry, error) {
 	for name, repo := range reg.Repos {
 		repo.Name = name
 		repo.Path = filepath.Join(reg.BasePath, name)
+		repo.registry = &reg
 
 		// Apply defaults if not set
 		if repo.CI == "" {
@@ -90,7 +97,8 @@ func LoadRegistry(path string) (*Registry, error) {
 
 // FindRegistry searches for repos.yaml in common locations.
 // It checks: current directory, parent directories, and home directory.
-func FindRegistry() (string, error) {
+// This function is primarily intended for use with io.Local or other local-like filesystems.
+func FindRegistry(m io.Medium) (string, error) {
 	// Check current directory and parents
 	dir, err := os.Getwd()
 	if err != nil {
@@ -99,7 +107,7 @@ func FindRegistry() (string, error) {
 
 	for {
 		candidate := filepath.Join(dir, "repos.yaml")
-		if io.Local.IsFile(candidate) {
+		if m.Exists(candidate) {
 			return candidate, nil
 		}
 
@@ -122,7 +130,7 @@ func FindRegistry() (string, error) {
 	}
 
 	for _, p := range commonPaths {
-		if io.Local.IsFile(p) {
+		if m.Exists(p) {
 			return p, nil
 		}
 	}
@@ -132,8 +140,9 @@ func FindRegistry() (string, error) {
 
 // ScanDirectory creates a Registry by scanning a directory for git repos.
 // This is used as a fallback when no repos.yaml is found.
-func ScanDirectory(dir string) (*Registry, error) {
-	entries, err := io.Local.List(dir)
+// The dir should be a valid path for the provided medium.
+func ScanDirectory(m io.Medium, dir string) (*Registry, error) {
+	entries, err := m.List(dir)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read directory: %w", err)
 	}
@@ -142,6 +151,7 @@ func ScanDirectory(dir string) (*Registry, error) {
 		Version:  1,
 		BasePath: dir,
 		Repos:    make(map[string]*Repo),
+		medium:   m,
 	}
 
 	// Try to detect org from git remote
@@ -153,21 +163,22 @@ func ScanDirectory(dir string) (*Registry, error) {
 		repoPath := filepath.Join(dir, entry.Name())
 		gitPath := filepath.Join(repoPath, ".git")
 
-		if !io.Local.IsDir(gitPath) {
+		if !m.IsDir(gitPath) {
 			continue // Not a git repo
 		}
 
 		repo := &Repo{
-			Name: entry.Name(),
-			Path: repoPath,
-			Type: "module", // Default type
+			Name:     entry.Name(),
+			Path:     repoPath,
+			Type:     "module", // Default type
+			registry: reg,
 		}
 
 		reg.Repos[entry.Name()] = repo
 
 		// Try to detect org from first repo's remote
 		if reg.Org == "" {
-			reg.Org = detectOrg(repoPath)
+			reg.Org = detectOrg(m, repoPath)
 		}
 	}
 
@@ -175,15 +186,13 @@ func ScanDirectory(dir string) (*Registry, error) {
 }
 
 // detectOrg tries to extract the GitHub org from a repo's origin remote.
-func detectOrg(repoPath string) string {
+func detectOrg(m io.Medium, repoPath string) string {
 	// Try to read git remote
 	configPath := filepath.Join(repoPath, ".git", "config")
-	content, err := io.Local.Read(configPath)
+	content, err := m.Read(configPath)
 	if err != nil {
 		return ""
 	}
-
-	// Simple parse for github.com URLs
 	// Look for patterns like github.com:org/repo or github.com/org/repo
 	for _, line := range strings.Split(content, "\n") {
 		line = strings.TrimSpace(line)
@@ -292,13 +301,20 @@ func (r *Registry) TopologicalOrder() ([]*Repo, error) {
 
 // Exists checks if the repo directory exists on disk.
 func (repo *Repo) Exists() bool {
-	return io.Local.IsDir(repo.Path)
+	return repo.getMedium().IsDir(repo.Path)
 }
 
 // IsGitRepo checks if the repo directory contains a .git folder.
 func (repo *Repo) IsGitRepo() bool {
 	gitPath := filepath.Join(repo.Path, ".git")
-	return io.Local.IsDir(gitPath)
+	return repo.getMedium().IsDir(gitPath)
+}
+
+func (repo *Repo) getMedium() io.Medium {
+	if repo.registry != nil && repo.registry.medium != nil {
+		return repo.registry.medium
+	}
+	return io.Local
 }
 
 // expandPath expands ~ to home directory.