diff --git a/.gitignore b/.gitignore
index 7cdd3c1..1688b7a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,7 @@
 # Forgejo runner registration file — contains a secret, never commit.
 runner/.runner
 *.env
+
+# Local secret notes — backup of credentials kept off git. NEVER commit.
+secrets.local.md
+*.local.secret
diff --git a/README.md b/README.md
index a0584d2..20c7058 100644
--- a/README.md
+++ b/README.md
@@ -204,4 +204,11 @@ No changes to this repo. In the new project:
   cert and risks Let's Encrypt rate limits.
 - **Least privilege:** restrict the deploy key in `authorized_keys` with a
   forced `command=` that only runs the compose pull/up script.
+- **Reset the admin password** (no email/old password needed): as an admin via
+  *Site Administration → User Accounts → (user) → Password*, or from the VPS:
+  ```sh
+  docker compose exec -u git forgejo \
+    forgejo admin user change-password --username <user> \
+    --password 'NEW' --must-change-password=false
+  ```
 ```