diff --git a/README.md b/README.md
index 8eb7caa..71177ab 100644
--- a/README.md
+++ b/README.md
@@ -322,14 +322,24 @@ Internet → Apache :80/:443 (git.jayfield.org vhost)
   hop itself is plain HTTP and Gitea otherwise has no way to know the
   original request arrived over TLS. Fixed and verified via the API.
 - **Verified end-to-end**: all previously-existing repos present via the
-  API (including this `docs-alpha.jayfield.org` repo), admin user
-  (`jayfield`) intact; a real `git clone` over HTTPS reproduced identical
-  commit history to the working copy; this repo's own `origin` remote
-  repointed to `https://git.jayfield.org/...` and a real `git push`
-  succeeded against it.
+  API (including this `docs-alpha.jayfield.org` repo), admin user (`jayfield`,
+  migrated over from `vlda-01`) intact; a real `git clone` over HTTPS
+  reproduced identical commit history to the working copy; this repo's own
+  `origin` remote repointed to `https://git.jayfield.org/...` and a real
+  `git push` succeeded against it.
 - **`vlda-01`'s copy**: left stopped (container not removed, data not
   deleted) as a cold backup — reversible if ever needed; not decommissioned
   outright.
+- **Admin user renamed `jayfield` → `jens` 2026-07-26** (password rotated at
+  the same time), via Gitea's own web admin panel (Site Administration →
+  User Accounts → Edit Account) rather than a direct DB/API edit — that's
+  the one code path that correctly moves the on-disk repo storage
+  directories and sets up a redirect together, rather than risking an
+  inconsistent rename. Verified: new credentials authenticate
+  (`GET /api/v1/user` → `"username":"jens"`), both the new canonical path
+  (`/jens/docs-alpha.jayfield.org`) and the old one (`/jayfield/...`, via
+  Gitea's automatic redirect) return `200`, and this repo's local `origin`
+  remote and stored git credentials were updated to match.
 
 ### Password vault sync (KeePass, via Nextcloud)