diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 1ca05a7..4020be7 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -95,7 +95,7 @@ dankserver.franksdank.cloud {
 # --- SearXNG (quadlet; behind the Gluetun tunnel, published 8081) ---
 search.franksdank.cloud {
 	basicauth {
-		dank REPLACE_WITH_HASH
+		dankuser REPLACE_WITH_HASH
 	}
 	reverse_proxy 192.168.0.143:8081
 }
@@ -108,7 +108,7 @@ comfyui.franksdank.cloud {
 # --- OpenWebUI (quadlet on slirp4netns; published 3005) ---
 chat.franksdank.cloud {
 	basicauth {
-		dank REPLACE_WITH_HASH
+		dankuser REPLACE_WITH_HASH
 	}
 	reverse_proxy 192.168.0.143:3005
 }
@@ -116,7 +116,7 @@ chat.franksdank.cloud {
 # --- Hermes ---
 hermes.franksdank.cloud {
 	basicauth {
-		dank REPLACE_WITH_HASH
+		dankuser REPLACE_WITH_HASH
 	}
 	reverse_proxy hermes:8090
 }
@@ -129,7 +129,7 @@ gitea.franksdank.cloud {
 # --- Grafana ---
 grafana.franksdank.cloud {
 	basicauth {
-		dank REPLACE_WITH_HASH
+		dankuser REPLACE_WITH_HASH
 	}
 	reverse_proxy grafana:3000
 }
@@ -137,7 +137,7 @@ grafana.franksdank.cloud {
 # --- Prometheus ---
 prometheus.franksdank.cloud {
 	basicauth {
-		dank REPLACE_WITH_HASH
+		dankuser REPLACE_WITH_HASH
 	}
 	reverse_proxy prometheus:9090
 }
@@ -172,7 +172,7 @@ books.franksdank.cloud {
 # --- RomM ---
 romm.franksdank.cloud {
 	basicauth {
-		dank REPLACE_WITH_HASH
+		dankuser REPLACE_WITH_HASH
 	}
 	reverse_proxy 192.168.0.235:8085
 }
@@ -180,7 +180,7 @@ romm.franksdank.cloud {
 # --- Copyparty ---
 files.franksdank.cloud {
 	basicauth {
-		dank REPLACE_WITH_HASH
+		dankuser REPLACE_WITH_HASH
 	}
 	reverse_proxy 192.168.0.235:3923
 }
diff --git a/tests/caddyfile.bats b/tests/caddyfile.bats
index fd34a4f..10a0018 100644
--- a/tests/caddyfile.bats
+++ b/tests/caddyfile.bats
@@ -72,7 +72,7 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
         echo "Caddyfile: bcrypt prefix before REPLACE_WITH_HASH (double-prefix regression)"
         return 1
     fi
-    grep -qE 'dank REPLACE_WITH_HASH' "$CADDYFILE"
+    grep -qE 'dankuser REPLACE_WITH_HASH' "$CADDYFILE"
 }
 
 @test "compose no longer defines the quadlet-replaced services" {
diff --git a/tests/deployment_flow.bats b/tests/deployment_flow.bats
index 56548ea..a825317 100644
--- a/tests/deployment_flow.bats
+++ b/tests/deployment_flow.bats
@@ -85,9 +85,9 @@ load helpers
     [ -n "$rendered" ]
     [[ "$rendered" == *"${hash}"* ]]
     ! grep -q 'REPLACE_WITH_HASH' <<< "$rendered"
-    # The rendered line must be exactly "dank <hash>". A template that keeps
-    # its own $2a$14$ prefix renders an invalid double-prefixed hash and
-    # every basicauth vhost returns 401 (2026-08-22 incident).
-    grep -qF "dank ${hash}" <<< "$rendered"
+    # The rendered line must be exactly "dankuser <hash>". A template that
+    # keeps its own $2a$14$ prefix renders an invalid double-prefixed hash
+    # and every basicauth vhost returns 401 (2026-08-22 incident).
+    grep -qF "dankuser ${hash}" <<< "$rendered"
     ! grep -qF '$2a$14$$2a$14$' <<< "$rendered"
 }