diff --git a/docs/history.md b/docs/history.md
index 5b26d62..22093c9 100644
--- a/docs/history.md
+++ b/docs/history.md
@@ -39,8 +39,14 @@ Every change, in order, with how to undo it:
    `"Cf-Access-Authenticated-User-Email"`, and `"192.168.16.1"` added to `trusted_proxies`. The
    file as it was is `config.toml.2026-09-12-sso.bak` beside it. Undo: copy the backup back and
    `docker compose -f /mnt/fast/arcane/projects/content/compose.yaml restart ipodderx`.
-4. **Cloudflare, Authentik, Docker networks and other containers**: unchanged. The `busybox` test
-   container was removed when it exited, and its image afterwards.
+4. **Cloudflare, Docker networks and other containers**: unchanged. The `busybox` test container
+   was removed when it exited, and its image afterwards.
+5. **Authentik**, later the same day, because ipodderx had no tile in its library while Outline
+   did: a bookmark application `ipodderx` (pk `5854a98e-816a-4c4f-9f27-63e69dc29d1d`), made
+   through the API with a token of Ray's. No provider and no policy bindings, like Outline's, the
+   iPodderX icon, and a link to `https://ipodderx.sdf1.net`. It changes nothing about who can sign
+   in. Undo: delete it under Applications → Applications, or
+   `DELETE /api/v3/core/applications/ipodderx/`.
 
 What the address trusts is any container on Tower that connects through the host's port, not only
 `cloudflared`. Verifying Cloudflare's signed `Cf-Access-Jwt-Assertion` would remove that, and is
diff --git a/docs/sso.md b/docs/sso.md
index f4c414e..2b11afc 100644
--- a/docs/sso.md
+++ b/docs/sso.md
@@ -89,6 +89,14 @@ send:
 docker exec iPodderX ipx user rename <old name> <email address>
 ```
 
+### The tile in Authentik's library
+
+Authentik's library lists Authentik's own applications, and ipodderx signs in through the one
+called `Cloudflare Access`, so ipodderx needs a bookmark of its own to show up there. It is
+Applications → Applications → `ipodderx`: no provider, launch URL `https://ipodderx.sdf1.net`, and
+the iPodderX icon. Like Outline's, it has no policy bindings, so everyone in Authentik sees the
+tile. Who actually gets in is still up to the Access policy.
+
 ### Check it
 
 ```sh