diff --git a/docs/remote-desktop.md b/docs/remote-desktop.md
index 5652c68..d37c65a 100644
--- a/docs/remote-desktop.md
+++ b/docs/remote-desktop.md
@@ -13,15 +13,15 @@ flow works normally. Open the terminal, run `claude`, log in through Chromium. D
 ## Stack
 - **Image:** lscr.io/linuxserver/webtop:ubuntu-xfce (Selkies/WebRTC)
 - **Bind:** 127.0.0.1:8131 (loopback only — never exposed directly)
-- **Edge:** Caddy reverse_proxy + basic_auth (TLS via Let's Encrypt)
+- **Edge:** Caddy reverse_proxy + Authentik forward_auth (your atlasshb identity)
 - **Persistence:** /opt/atlas/webtop/config (home survives restarts)
 - **Pre-installed:** Claude Code CLI (on PATH), Chromium, XFCE terminal;
   desktop launchers for Claude + Chromium
 
 ## Compose
-See `deploy/webtop-docker-compose.yml`. Credentials live in a local `.env`
+See `deploy/webtop-docker-compose.yml`. Auth is your Authentik identity (no separate password). Old basic_auth creds in a local `.env`
 (gitignored) and the Caddy basic_auth hash — never committed.
 
 ## Roadmap
-- Migrate edge auth from Caddy basic_auth to Authentik SSO (consistent identity)
+- DONE: edge auth is Authentik SSO (atlasshb identity)
 - Optional: pin Claude to the Max subscription via the in-desktop browser login