diff --git a/serverAppConfigs-docs/Dankclaw/OpenWebUI.md b/serverAppConfigs-docs/Dankclaw/OpenWebUI.md
index 3b86116..85cffb0 100644
--- a/serverAppConfigs-docs/Dankclaw/OpenWebUI.md
+++ b/serverAppConfigs-docs/Dankclaw/OpenWebUI.md
@@ -116,6 +116,14 @@ browser-driven and only touches the two exempt vhosts (`ai.` and `auth.`).
   Panel is authoritative. To rotate the client secret: create a new token in
   authentik, update the host env file, and set the new value in the Admin
   Panel (or the DB), then restart the container.
+- **SSO-only (2026-09-24):** after the OIDC round-trip was verified, the local
+  username/password path was retired. `ENABLE_LOGIN_FORM=false` hides the form
+  and `ENABLE_PASSWORD_AUTH=false` refuses password logins, so the only way in
+  is the authentik OIDC flow. The `ui.enable_login_form` config-DB override was
+  flipped to `false` in the same change — the per-key DB wins over env, so both
+  must agree, and the DB value is the one to change on a live data dir. To
+  restore the password form: set `ui.enable_login_form` back to `true` in the
+  Admin Panel (or DB) and drop the two env vars from the quadlet.
 
 
 ## Boot persistence (Quadlet)
@@ -160,6 +168,8 @@ The quadlet carries a built-in healthcheck (30s interval, 3 retries, 300s start
 
 - **2026-09-24 — SSO via authentik.** OIDC authorization-code flow wired per the [SSO (authentik)](#sso-authentik) section: application/provider/entitlements created in authentik, client secret in the host env file, roles from the `roles` scope claim. E2E coverage in `tests/e2e/specs/18-openwebui-sso.spec.ts`.
 
+- **2026-09-24 — flipped to SSO-only.** The OIDC round-trip verified in a real browser (login view renders no password form, only "Continue with authentik", and the flow lands on a signed-in session), so the local username/password path was retired: `ENABLE_LOGIN_FORM=false` + `ENABLE_PASSWORD_AUTH=false` in the quadlet and `ui.enable_login_form` set to `false` in the config DB (the DB wins over env, so both were changed together). `qa-e2e-admin` was demoted out of the `authentik Admins` group (it keeps `openwebui_users` / `homepage-admins` for app access).
+
 ## See Also
 
 - [[Dankclaw Stack]]