diff --git a/CommunityDiscordMedia.md b/CommunityDiscordMedia.md
index 72fd262..b761b13 100644
--- a/CommunityDiscordMedia.md
+++ b/CommunityDiscordMedia.md
@@ -258,7 +258,8 @@ Same pattern as Jellyfin: Authentik is the identity, Gitea trusts it.
 - [x] Gitea env: `DISABLE_REGISTRATION=false` + `ALLOW_ONLY_EXTERNAL_REGISTRATION=true` (local self-signup stays
       off), `ENABLE_AUTO_REGISTRATION`, `ACCOUNT_LINKING=auto`, `USERNAME=nickname`, `UPDATE_AVATAR`
 - [ ] optional: hide the password form on the login page (custom template) so Discord is the only visible way in
-- [ ] Authentik group `git-users` (from a Discord role) bound on the `Gitea` application (+ `admins`); only they can log in
+- [ ] Authentik groups `git-users` and `git-admins` bound on the `Gitea` application; Gitea admin claim = `git-admins`;
+      nesting `authentik Admins` → `admins` → `git-admins` so admins inherit it
 - [ ] test with a non-admin Discord user; confirm admin mapping via `admins` group
 
 ### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere)  ✅ live
diff --git a/README.md b/README.md
index 85a89d7..d1cb732 100644
--- a/README.md
+++ b/README.md
@@ -212,11 +212,13 @@ Keep repo write access to trusted people.
 2. Gitea → Site Administration → Identity & Access → Authentication Sources → Add: type **OAuth2**, name
    **`authentik`** (must match the callback path), provider **OpenID Connect**, client ID/secret, OpenID Connect
    Auto Discovery URL `https://auth.HOST/application/o/gitea/.well-known/openid-configuration`, tick "Skip local
-   2FA", claim name for groups `groups`, administrator group claim value `admins`. Save.
+   2FA", claim name for groups `groups`, administrator group claim value **`git-admins`**. Save.
+   Authentik group nesting makes the admins inherit it: `authentik Admins` → parent `admins` → parent `git-admins`
+   (members of a child group count as members of the parent, in the `groups` claim and in Caddy's header checks).
 3. compose (already set): registration only via external sources, auto-registration + account linking on,
    username from `preferred_username`. A first Discord login creates the Gitea user with no form.
 4. Access = Authentik group **`git-users`**: Directory → Groups → create it (add a Discord role to it in the
-   roles→groups table); Applications → `Gitea` → Policy / Group / User Bindings → bind `git-users` (and `admins`).
+   roles→groups table); Applications → `Gitea` → Policy / Group / User Bindings → bind `git-users` and `git-admins`.
    Non-members are refused by Authentik before Gitea sees them.
 5. Test in a private window: https://git.HOST/user/login → "Sign in with authentik" → Discord → logged in.
    Members of `admins` become Gitea site admins on login. The local admin account stays as a fallback.