diff --git a/CommunityDiscordMedia.md b/CommunityDiscordMedia.md
index 52c5526..72fd262 100644
--- a/CommunityDiscordMedia.md
+++ b/CommunityDiscordMedia.md
@@ -258,7 +258,7 @@ Same pattern as Jellyfin: Authentik is the identity, Gitea trusts it.
 - [x] Gitea env: `DISABLE_REGISTRATION=false` + `ALLOW_ONLY_EXTERNAL_REGISTRATION=true` (local self-signup stays
       off), `ENABLE_AUTO_REGISTRATION`, `ACCOUNT_LINKING=auto`, `USERNAME=nickname`, `UPDATE_AVATAR`
 - [ ] optional: hide the password form on the login page (custom template) so Discord is the only visible way in
-- [ ] policy on the Authentik application: who may reach Gitea at all (e.g. `admins` + a `devs` group)
+- [ ] Authentik group `git-users` (from a Discord role) bound on the `Gitea` application (+ `admins`); only they can log in
 - [ ] test with a non-admin Discord user; confirm admin mapping via `admins` group
 
 ### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere)  ✅ live
diff --git a/README.md b/README.md
index deb23b9..85a89d7 100644
--- a/README.md
+++ b/README.md
@@ -215,7 +215,10 @@ Keep repo write access to trusted people.
    2FA", claim name for groups `groups`, administrator group claim value `admins`. Save.
 3. compose (already set): registration only via external sources, auto-registration + account linking on,
    username from `preferred_username`. A first Discord login creates the Gitea user with no form.
-4. Test in a private window: https://git.HOST/user/login → "Sign in with authentik" → Discord → logged in.
+4. Access = Authentik group **`git-users`**: Directory → Groups → create it (add a Discord role to it in the
+   roles→groups table); Applications → `Gitea` → Policy / Group / User Bindings → bind `git-users` (and `admins`).
+   Non-members are refused by Authentik before Gitea sees them.
+5. Test in a private window: https://git.HOST/user/login → "Sign in with authentik" → Discord → logged in.
    Members of `admins` become Gitea site admins on login. The local admin account stays as a fallback.
 Optional later: hide the password form (custom template) so Discord is the only visible way in.
 
diff --git a/authentik/discord-roles-to-groups.py b/authentik/discord-roles-to-groups.py
index f7f95b4..9ce6410 100644
--- a/authentik/discord-roles-to-groups.py
+++ b/authentik/discord-roles-to-groups.py
@@ -13,6 +13,7 @@ ROLE_TO_GROUP = {                                       # <- Discord role id : A
 #    "222222222222222222": "streamers",
 #    "333333333333333333": "editors",
 #    "444444444444444444": "admins",
+    "555555555555555555": "git-users",
 }
 
 from authentik.core.models import Group