diff --git a/CLAUDE.md b/CLAUDE.md
index 9c0f3dd..ada3553 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -66,7 +66,6 @@ kubectl apply -f rendered/envs/production/<app>/ --server-side  # Deploy
 
 
 ## Known Issues / TODOs
-- **Forgejo admin password**: Hardcoded in rendered secrets (`r8sA8CPHD9!bt6d`). Move to external secret before pushing to git.
 - **Namespace race condition**: First `kubectl apply` of a new app often fails because namespace isn't ready. Re-apply once.
 - **Traefik DaemonSet updates**: Requires `updateStrategy.rollingUpdate.maxSurge: 0` because hostPort conflicts prevent surge.
 - **Forgejo Ingress API version**: Chart renders `extensions/v1beta1`, fixed via `ytt/ingress-fix.ytt.yaml` overlay to `networking.k8s.io/v1`.