diff --git a/app/main.py b/app/main.py
index 9fe8fc4..6ddf76b 100644
--- a/app/main.py
+++ b/app/main.py
@@ -207,9 +207,12 @@ WEBHOOK_TOKEN = os.environ.get("WEBHOOK_TOKEN", "")
 # generic webhooks cannot send headers), so anything that learns that URL — an OC
 # admin, OC's logs, this app's own access logs, a Referer — used to gain portal
 # admin. ADMIN_TOKEN is only ever sent as a header and never appears in a URL.
-# Cutover: while ADMIN_TOKEN_LEGACY is not "0" we also accept WEBHOOK_TOKEN on
-# /admin/* so the admin panel, the scheduler and the digest scripts keep working.
-# Set ADMIN_TOKEN everywhere, then set ADMIN_TOKEN_LEGACY=0 and rotate both.
+# Cutover COMPLETE (2026-10-28): ADMIN_TOKEN_LEGACY=0, so the legacy token no
+# longer authenticates here (verified: ADMIN_TOKEN -> 200, WEBHOOK_TOKEN -> 403).
+# ADMIN_TOKEN was minted new on 2026-10-27 and WEBHOOK_TOKEN was rotated the same
+# day, so NO rotation is outstanding — do not "finish" this by rotating again.
+# Callers must read ADMIN_TOKEN and fail loudly; never fall back to WEBHOOK_TOKEN,
+# which 403s and would turn a missing variable into a mid-run failure.
 ADMIN_TOKEN = os.environ.get("ADMIN_TOKEN", "")
 ADMIN_TOKEN_LEGACY = os.environ.get("ADMIN_TOKEN_LEGACY", "1") != "0"