diff --git a/docs/Dankclaw/Gitea.md b/docs/Dankclaw/Gitea.md
index 86b0384..635356d 100644
--- a/docs/Dankclaw/Gitea.md
+++ b/docs/Dankclaw/Gitea.md
@@ -84,6 +84,7 @@ Back up `/opt/gitea/data/` (tar) or `pg_dump` the database. See the knowledge ba
 - **The host auto-reboots.** `unattended-upgrades` reboots Dankclaw when a package needs it. The quadlet units make Gitea survive that. See the 2026-08-16 incident below.
 - **Port 3000 vs 3001.** The live host port is 3000. The full-stack [`dankclaw/compose.yaml`](../compose.yaml) maps 3001. Align the two before deploying the full stack.
 - **Legacy compose retired.** `/opt/gitea/podman-compose.yml` is retired to `/opt/gitea/.deprecated/`. Do not run it; its containers would collide with the quadlet units on ports 3000, 2222, 80, and 443.
+- **Rootless cannot bind ports below 1024 by default.** `gitea-caddy` publishes 80 and 443. Without a host sysctl, `rootlessport` fails with `permission denied` and the unit crash-loops under `Restart=always`. The fix is a one-time sysctl: `net.ipv4.ip_unprivileged_port_start=80`, persisted in `/etc/sysctl.d/99-rootless-ports.conf`. Applied 2026-08-18 after a 13,000-restart crash loop.
 
 ## Incident: 2026-08-16 — down after unattended reboot