diff --git a/deploy/README.md b/deploy/README.md
index 45d05a6..e2ae741 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -52,11 +52,19 @@ Copy `profile/*.toml` to `~/config/news2/`. A bind-mounted config edit needs
 container when only a mounted file changed. An **environment** change does need
 the full `up -d`.
 
-## 2. Caddy
+## 2. Caddy — APPLIED 2026-09-08
 
-The existing `news.rcjohnstone.com` block serves a static SPA from
-`/srv/news/dist` and proxies only `/api*`. This app renders its own pages, so
-the block simplifies -- but it must also become reachable from the phone.
+Done. The block was moved out of the "Internal only" section into the Public
+section (the section headers are load-bearing documentation, and leaving a
+public block under an internal header would make the file lie), given a
+`# ddns: public` marker, and reloaded. `ddns_update` published the A record and
+Let's Encrypt issued a cert for the name.
+
+Snapshot of the previous file: `~/Caddyfile.pre-news-public`.
+
+Verified after reload: `/` and `/healthz` return 403 (Authelia gating), while
+`/api/feedback/...` returns 404 -- a 404 from the OLD backend, which proves
+Caddy routed it through without authentication.
 
 ```
 # ddns: public
@@ -91,8 +99,18 @@ that, feedback buttons fail on cellular and the digest link is unopenable away
 from home -- and silent failure there is precisely how the previous version
 ended up with 32 labels in a week.
 
-`/srv/news/dist` becomes unused and the `news-update` systemd timer that
-populated it can be disabled.
+`/srv/news/dist` is now unused and the root-owned `news-update` systemd timer
+that populated it should be disabled:
+
+```sh
+sudo systemctl disable --now news-update.timer
+```
+
+**Current state:** the vhost is public and correctly gated, but `news-backend`
+is still the old Rust service, which no longer has its SPA served by Caddy. So
+`https://news.rcjohnstone.com/` is a 404 behind the login until the compose
+service is switched to this image. Notifications from the old service are
+unaffected.
 
 ## 3. Scheduling