diff --git a/dankclaw/open-webui/quadlet/open-webui.container b/dankclaw/open-webui/quadlet/open-webui.container
index c46d9c3..40bf3e1 100644
--- a/dankclaw/open-webui/quadlet/open-webui.container
+++ b/dankclaw/open-webui/quadlet/open-webui.container
@@ -56,6 +56,14 @@ Environment=ENABLE_OAUTH_SIGNUP=true
 Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
 Environment="OAUTH_SCOPES=openid email profile roles"
 Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true
+# SSO-only (2026-09-24): the OIDC round-trip is verified, so the local
+# username/password path is retired. ENABLE_LOGIN_FORM hides the form;
+# ENABLE_PASSWORD_AUTH refuses password logins entirely, so the only way in
+# is the authentik OIDC flow (which folds into the local account by email).
+# The per-key config DB override (ui.enable_login_form) is flipped to false
+# in the same change — the DB wins over env, so both must agree.
+Environment=ENABLE_LOGIN_FORM=false
+Environment=ENABLE_PASSWORD_AUTH=false
 
 # Web search -> SearXNG, reached over the host-published port (NOT the
 # search.franksdank.cloud vhost): the Anubis->Authentik guard chain is a