diff --git a/apps/authentik/values.yaml b/apps/authentik/values.yaml
index d6506b3..514168d 100644
--- a/apps/authentik/values.yaml
+++ b/apps/authentik/values.yaml
@@ -67,7 +67,9 @@ authentik:
     enabled: false
 
   server:
-    replicas: 1
+    # Final-cutover maintenance window: prevent writes to the destination while
+    # its trial snapshot is replaced. Return this to 1 after the final restore.
+    replicas: 0
     # UID/GID 1000 matches the restored Docker files and satisfies this
     # namespace's restricted Pod Security policy without running as root.
     securityContext:
diff --git a/docs/network.md b/docs/network.md
index c9d1e0c..c508403 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -84,7 +84,7 @@ Cloudflare; internal overrides are served by Technitium where noted.
 | Hostname | App | Namespace | TLS | Source |
 |---|---|---|---|---|
 | `demo.ahmza.com` | Demo app | `demo` | Yes — `letsencrypt-prod`, real trusted cert (see [`docs/12-cert-manager.md`](12-cert-manager.md)) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) |
-| `auth.ahmza.com` | Authentik identity provider | `authentik` | Configured for `letsencrypt-prod`; staging certificate and HTTPS routing verified; Technitium routes LAN clients to `10.10.60.12` | [`apps/authentik/values.yaml`](../apps/authentik/values.yaml) |
+| `auth.ahmza.com` | Authentik identity provider | `authentik` | Yes — `letsencrypt-prod`, trusted certificate and browser login verified; Technitium routes LAN clients to `10.10.60.12` | [`apps/authentik/values.yaml`](../apps/authentik/values.yaml) |
 | `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) |
 | `bazarr.ahmza.com` | Bazarr subtitle manager | `bazarr` | Yes — `letsencrypt-prod`, real trusted certificate; Technitium overrides Cloudflare's NetBird route on the LAN | [`apps/bazarr/ingress.yaml`](../apps/bazarr/ingress.yaml) |
 | `soulsync.ahmza.com` | SoulSync media discovery | `soulsync` | Configured for `letsencrypt-prod`; verify the certificate after the first deployment; Technitium routes LAN clients to `10.10.60.12` | [`apps/soulsync/ingress.yaml`](../apps/soulsync/ingress.yaml) |