diff --git a/README.md b/README.md
index aa55f94..f12d2d6 100644
--- a/README.md
+++ b/README.md
@@ -80,8 +80,14 @@ Everything else is dropped and a trickle is logged (`journalctl -k | grep vg-dro
 Jellyfin (8096), copyparty, the Syncthing UI and dumpd bind to 127.0.0.1 only and are reached via Caddy
 or an ssh tunnel, so they are deliberately not opened. MariaDB runs on the host network (not a Docker
 published port) precisely so the firewall can govern it.
-Syncthing's admin UI is proxied at `https://HOST/sync/` behind Syncthing's own GUI login (set it in
-Actions → Settings → GUI before relying on this). The ssh tunnel to 8384 still works as a fallback.
+Syncthing's admin UI is proxied at `https://HOST/sync/` behind the Authentik gate + group `media-admins`; its
+own GUI login is disabled (no user/password, `insecureAdminAccess=true`) so Discord is the only login:
+
+    docker exec syncthing syncthing cli --home /var/syncthing/config config gui insecure-admin-access set true
+    docker exec syncthing syncthing cli --home /var/syncthing/config config gui user set ""
+    docker exec syncthing syncthing cli --home /var/syncthing/config config gui password set ""
+
+The ssh tunnel to 8384 still works as an admin fallback (no login at all — ssh is the gate there).
 
 To change rules: edit `/etc/nftables.conf`, then `sudo nft -f /etc/nftables.conf` or
 `sudo systemctl reload nftables`. **Never `systemctl stop|restart nftables`** — Debian's unit flushes
diff --git a/STATUS.md b/STATUS.md
index 096a9d1..9382f09 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -36,7 +36,7 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 | Devs | Host code, review, CI | Gitea `https://git.…/`, ssh 2222 | Discord (Authentik), group `git-users`; `git-admins` = site admin |
 | Bot dev | Push code, restart container, read logs; web UI at `https://bot.…/` | Gitea + compose; `bot/AGENT.md` | web UI behind Discord (Authentik), once its provider exists |
 | Admin | Hostnames, bot token/guild, webhook; streamers/editors are Discord roles → Authentik groups | `./configure.py` | ssh |
-| Admin | Pair a gamer's device, approve their folder | Syncthing UI `https://ovh1…/sync/` | Discord + group `media-admins`, then Syncthing's GUI password |
+| Admin | Pair a gamer's device, approve their folder | Syncthing UI `https://ovh1…/sync/` | Discord + group `media-admins` (Syncthing's own login disabled) |
 | Admin | Groups, who may log in, app access | Authentik `https://auth.…/` | Discord or akadmin |
 | Admin | Install/upgrade the Jellyfin plugin | `./installJellyfinPlugin.sh` | ssh |
 | Admin | Register the CI runner | `./registerGiteaRunner.sh` | ssh |
@@ -49,7 +49,7 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 | copyparty | browse/scrub/download/finals upload | behind Authentik, group permissions (`editors`, `media-admins`), Discord-only, no WebDAV | live |
 | dumpd + dock | dump, stream tokens, MediaMTX auth hook, `/time`; OBS dock with timecode-band setup | identity from Authentik headers | live |
 | Timecode | `bin/vgstrip.py` decoder, `tmcd` + sidecar in the sweep, `/dock/clock/` strip page, Go Live band composite, portal crop | server clock is the reference | **live, verified** (OBS: frame-accurate, 0 gaps) |
-| Syncthing | clip intake, UI at `/sync/` | UI behind Authentik + `media-admins` | live |
+| Syncthing | clip intake, UI at `/sync/` | UI behind Authentik + `media-admins`, own GUI auth off | live |
 | normalize sweep | editing standard, one copy per clip | live |
 | nftables | host firewall (22, 80/443, 1935, 2222, 3306, 8890/udp, 22000) | live |
 | Caddy | TLS + routing for all hostnames | live |
diff --git a/configure.py b/configure.py
index 9c1bd6f..0058f8a 100755
--- a/configure.py
+++ b/configure.py
@@ -263,7 +263,7 @@ name:   {{http.request.header.X-Authentik-Name}}"
 		reverse_proxy 127.0.0.1:8080          # server clock for the timecode strip
 	}}
 
-	# Syncthing admin UI: Authentik + group {sync_group or 'any'}; Syncthing's own GUI login stays as a second layer
+	# Syncthing admin UI: Authentik + group {sync_group or 'any'} (Syncthing's own GUI login is disabled)
 {sync_gate}	redir /sync /sync/ 308
 	handle_path /sync/* {{
 		reverse_proxy 127.0.0.1:8384 {{