diff --git a/docs/SETUP.md b/docs/SETUP.md
index 1f37862..f6fe203 100644
--- a/docs/SETUP.md
+++ b/docs/SETUP.md
@@ -70,7 +70,7 @@ references — no placeholder-swapping needed).
    Repository** → name `cloud-demo`. Leave it empty — don't initialize with
    a README/`.gitignore`/license, since this repo already has its own.
    Visibility (public/private) is your call; either works, since access for
-   `k8s`/Flux/CI goes through the deploy key below regardless.
+   `k8s`/Flux/CI goes through the tokens below regardless.
 2. Locally, wherever you're editing this repo (`maq`):
    ```sh
    git init   # if not already
@@ -79,13 +79,25 @@ references — no placeholder-swapping needed).
    git remote add origin https://git.boglabob.com/codegit/cloud-demo.git
    git push -u origin main
    ```
-3. Add `k8s`'s public key (`~/.ssh/k3s_homelab.pub` from step 2, on the
-   T630 — `cat ~/.ssh/k3s_homelab.pub` as `k8s` if you need to grab it
-   again) as a Deploy Key on this repo — `Settings → Deploy Keys` — **with
-   write access**. One key, added once, covers `k8s`'s `git clone`/`pull`
-   (step 5) *and* `flux bootstrap` (step 7) *and*
-   `ImageUpdateAutomation`'s commits back (step 10), since all three reuse
-   this same keypair.
+3. Generate two access tokens (`Settings → Applications → Generate New
+   Token`), scoped as narrowly as Forgejo's token UI allows to repository
+   read/write:
+   - **`k8s-readonly`** — read-only. Used only for `k8s`'s own manual
+     `git clone`/`pull` on the T630 (step 5) — never leaves that box, isn't
+     used by anything automated.
+   - **`flux-write`** — read/write. Used once, as a `flux bootstrap`
+     argument (step 7); Flux stores it as a Kubernetes Secret inside the
+     cluster from then on (`ImageUpdateAutomation`'s commits back in step 10
+     reuse that same in-cluster Secret) — it's never written to `k8s`'s
+     filesystem at all.
+
+   Using HTTPS tokens instead of `k8s`'s SSH key (`~/.ssh/k3s_homelab`, from
+   step 2) sidesteps an open question: Forgejo's git-SSH port isn't
+   reachable from this desktop through your router (see the SSH
+   troubleshooting earlier in this conversation), and whether it's reachable
+   from `k8s` on the T630 itself was never actually confirmed either. HTTPS
+   (443, via Caddy) is already proven to work, so both tokens use that
+   instead. Copy both token values now — Forgejo only shows them once.
 
 ## 5. Provision the VMs with OpenTofu
 
@@ -101,12 +113,18 @@ sudo sh install-opentofu.sh --install-method standalone && rm install-opentofu.s
 ```
 
 Everything from here on is `k8s` again (`sudo -iu k8s`), no sudo involved —
-clone using the deploy key from step 4:
+clone using the `k8s-readonly` token from step 4. `k8s` has no keyring (it's
+headless, no desktop session), so this uses `git credential-store` — a
+plaintext file, `chmod 600`'d, holding only the read-only token:
 
 ```sh
 # as k8s
-GIT_SSH_COMMAND="ssh -i ~/.ssh/k3s_homelab" \
-  git clone git@git.boglabob.com:codegit/cloud-demo.git ~/k3s
+git config --global credential.helper store
+git clone https://git.boglabob.com/codegit/cloud-demo.git ~/k3s
+# prompts for username (anything) and password (paste the k8s-readonly
+# token) once; stores it in ~/.git-credentials for next time
+chmod 600 ~/.git-credentials
+
 cd ~/k3s/terraform
 cp terraform.tfvars.example terraform.tfvars
 # edit terraform.tfvars: ssh_public_key (contents of ~/.ssh/k3s_homelab.pub
@@ -145,22 +163,31 @@ whenever you need kubectl — simplest by far for a project this size.
 ## 7. Bootstrap Flux against Forgejo
 
 Forgejo isn't a Flux-native provider (unlike GitHub/GitLab), so use the
-generic git bootstrap, reusing `k8s`'s keypair — already added as a write
-deploy key in step 4, so unlike a default `flux bootstrap` run, this one
-won't print a new key to add:
+generic git bootstrap — over HTTPS with the `flux-write` token from step 4,
+not SSH (same reachability reasoning as step 5):
 
 ```sh
 brew install fluxcd/tap/flux
 flux check --pre --kubeconfig ~/.kube/config-homelab
 
 flux bootstrap git \
-  --url=ssh://git@git.boglabob.com:22/codegit/cloud-demo.git \
+  --url=https://git.boglabob.com/codegit/cloud-demo \
   --branch=main \
   --path=clusters/homelab \
-  --private-key-file=~/.ssh/k3s_homelab \
+  --username=codegit \
+  --password=<FLUX_WRITE_TOKEN> \
+  --token-auth \
   --kubeconfig ~/.kube/config-homelab
 ```
 
+`--password` here is the `flux-write` token, not an actual account
+password. Flux stores it as a Kubernetes Secret in the `flux-system`
+namespace once bootstrap completes — that Secret is what
+`ImageUpdateAutomation` (step 10) reuses to push commits back, not anything
+held by `k8s` itself. Clear this command from `k8s`'s shell history
+afterwards (or prefix it with a space first, if `HISTCONTROL=ignorespace`
+is set) since the token was passed as a plain argument.
+
 This populates `clusters/homelab/flux-system/` and, because
 `clusters/homelab/apps.yaml` already declares `Kustomization` objects for
 `apps/podinfo` and `apps/hello-app`, both start reconciling immediately.