diff --git a/CommunityDiscordMedia.md b/CommunityDiscordMedia.md
index 32903ab..74c65bc 100644
--- a/CommunityDiscordMedia.md
+++ b/CommunityDiscordMedia.md
@@ -38,7 +38,8 @@ Bundle: `vanguard-stream/` in this repo; live copy at `~/vanguard-stream` on the
 - **Hostnames:** `auth.` and `watch.` are CNAMEs to the main host. Caddy routes by SNI, Let's Encrypt
   follows CNAMEs. One A record to change if the IP ever moves.
 - **Discord login only, no passwords anywhere** → no WebDAV (a mounted drive can't do a browser login).
-  Editors download from copyparty's web UI (zip/tar for folders).
+  Editors download from copyparty's web UI (zip/tar for folders). WebDAV stays *available* (Authentik
+  "Intercept header authentication" + per-user app passwords, no code change) if we ever choose it.
 
 ## Target layout
 
diff --git a/README.md b/README.md
index 586953c..4840101 100644
--- a/README.md
+++ b/README.md
@@ -251,6 +251,12 @@ including `/trash`. Scrub any `.mp4` in the browser, download what you want.
 No WebDAV: login is Discord only (no passwords of any kind), and a mounted drive cannot do a browser login.
 Download from the browser: single files, or select files/folders and use copyparty's zip/tar download.
 
+> **Available but not set up.** WebDAV mounts can be enabled later without code changes if we decide we want
+> them: in Authentik, edit the `Vanguard sites` proxy provider and tick **Intercept header authentication**;
+> each editor then creates an *app password* under their Authentik user settings and mounts the same URL with
+> their Authentik username + that app password. Caddy and copyparty already pass the identity through, so
+> nothing else changes. It is off because it introduces a password-like credential alongside Discord login.
+
 Every `.mp4` an editor sees is the same kind of file (see "Editing standard"). Raw clipper output that
 needed converting is kept in a hidden `.src/` folder next to it (media-admins can show dotfiles in copyparty).