diff --git a/README.md b/README.md
index bb37d82a..651b1444 100644
--- a/README.md
+++ b/README.md
@@ -93,7 +93,7 @@ printf '%s' 'your-password' | argon2 "$(openssl rand -hex 8)" -id -e -t 2 -m 16
 |:---------|:--------|
 | `QLAWKUS_ADMIN_PASSWORD_HASH` | Argon2id PHC hash for the `qlawkus` admin user (override the username with `QLAWKUS_ADMIN_USERNAME`) |
 
-`%dev` keeps a known password (`qlawkus`) for local development only. In production, store the hash via the env var above or the encrypted secrets keystore (`PUT /api/admin/secrets`, alias `qlawkus.admin.password-hash`) — see [`site/content/secrets.adoc`](site/content/secrets.adoc).
+`%dev` keeps a known password (`dev`) for local development only. In production, store the hash via the env var above or the encrypted secrets keystore (`PUT /api/admin/secrets`, alias `qlawkus.admin.password-hash`), see [`site/content/secrets.adoc`](site/content/secrets.adoc).
 
 ### Environment Variables
 
@@ -367,7 +367,7 @@ The full admin surface — including per-property config editing and the `agent.
 
 ```bash
 curl -X POST http://localhost:8080/api/chat \
-  -u qlawkus:qlawkus \
+  -u qlawkus:dev \
   -H "Content-Type: application/json" \
   -d '{"message": "Hello, who are you?"}'
 ```
diff --git a/docs/modules/ROOT/pages/quickstart.adoc b/docs/modules/ROOT/pages/quickstart.adoc
index c8962084..a4750d89 100644
--- a/docs/modules/ROOT/pages/quickstart.adoc
+++ b/docs/modules/ROOT/pages/quickstart.adoc
@@ -28,7 +28,7 @@ TIP: The first build takes a few minutes. Subsequent starts are much faster.
 
 [source,bash]
 ----
-curl -X POST http://localhost:8080/api/chat/sync -u qlawkus:qlawkus \
+curl -X POST http://localhost:8080/api/chat/sync -u qlawkus:dev \
   -H 'Content-Type: application/json' -d '{"message":"Hello, who are you?"}'
 ----
 
@@ -77,7 +77,7 @@ TIP: `./run.sh prod logs` follows the app logs and `./run.sh prod down` stops th
 
 == Authentication
 
-All HTTP endpoints use Basic auth (`quawkus` / `qlawkus` by default, override with `API_USER_PASSWORD`).
+All HTTP endpoints require authentication. The bundled `app` verifies HTTP Basic against an *Argon2id* password hash, database-free (see xref:secrets.adoc[Secrets]). In dev mode (`quarkus:dev`) the credentials are **`qlawkus` / `dev`**, from a hash baked into the `%dev` profile. Any non-dev run is fail-closed: the app refuses to boot until you provide an Argon2id hash of your own password, under the keystore alias `qlawkus.admin.password-hash` or the environment variable `QLAWKUS_ADMIN_PASSWORD_HASH`. The username defaults to `qlawkus` (`qlawkus.admin.username`).
 
 == What's next?
 
diff --git a/scripts/memory-benchmark.sh b/scripts/memory-benchmark.sh
index efde646b..d53d2715 100755
--- a/scripts/memory-benchmark.sh
+++ b/scripts/memory-benchmark.sh
@@ -7,13 +7,13 @@
 # long-term memory (owner profile injection or active-memory retrieval), never the chat window.
 #
 # Usage:
-#   BASE=http://localhost:8742 AUTH=qlawkus:qlawkus SLEEP=25 ./scripts/memory-benchmark.sh
+#   BASE=http://localhost:8742 AUTH=qlawkus:<admin-password> SLEEP=25 ./scripts/memory-benchmark.sh
 #
 # Requires: curl, and `docker compose exec postgres` for window wipes (override WIPE_CMD otherwise).
 set -u
 
 BASE="${BASE:-http://localhost:8742}"
-AUTH="${AUTH:-qlawkus:qlawkus}"
+AUTH="${AUTH:-qlawkus:dev}"              # dev-mode credential; for a containerized instance set your configured admin password
 SLEEP="${SLEEP:-25}"                      # throttle between LLM turns (rate-limit friendly)
 PSQL="${PSQL:-docker compose exec -T postgres psql -U qlawkus -d qlawkus}"
 
diff --git a/site/content/quickstart.adoc b/site/content/quickstart.adoc
index c8962084..a4750d89 100644
--- a/site/content/quickstart.adoc
+++ b/site/content/quickstart.adoc
@@ -28,7 +28,7 @@ TIP: The first build takes a few minutes. Subsequent starts are much faster.
 
 [source,bash]
 ----
-curl -X POST http://localhost:8080/api/chat/sync -u qlawkus:qlawkus \
+curl -X POST http://localhost:8080/api/chat/sync -u qlawkus:dev \
   -H 'Content-Type: application/json' -d '{"message":"Hello, who are you?"}'
 ----
 
@@ -77,7 +77,7 @@ TIP: `./run.sh prod logs` follows the app logs and `./run.sh prod down` stops th
 
 == Authentication
 
-All HTTP endpoints use Basic auth (`quawkus` / `qlawkus` by default, override with `API_USER_PASSWORD`).
+All HTTP endpoints require authentication. The bundled `app` verifies HTTP Basic against an *Argon2id* password hash, database-free (see xref:secrets.adoc[Secrets]). In dev mode (`quarkus:dev`) the credentials are **`qlawkus` / `dev`**, from a hash baked into the `%dev` profile. Any non-dev run is fail-closed: the app refuses to boot until you provide an Argon2id hash of your own password, under the keystore alias `qlawkus.admin.password-hash` or the environment variable `QLAWKUS_ADMIN_PASSWORD_HASH`. The username defaults to `qlawkus` (`qlawkus.admin.username`).
 
 == What's next?