diff --git a/hosts/heather/caddy.nix b/hosts/heather/caddy.nix
index c706481..9446722 100644
--- a/hosts/heather/caddy.nix
+++ b/hosts/heather/caddy.nix
@@ -15,11 +15,13 @@
 
 let
   # caddy/basic-auth под паролем. hash сгенерить:
-  #   caddy hash-password
-  # Пока заглушка — syncthing GUI имеет свой пароль + Caddy basicauth сверху.
+  #   caddy hash-password --plaintext '<password>'
+  # (на heather: nix-shell -p caddy --run 'caddy hash-password ...')
+  # Защищает syncthing GUI снаружи (GUI слушает только 127.0.0.1:8384,
+  # Caddy проксирует sync.iscg.dev + basicauth).
   syncBasicAuth = ''
     basicauth {
-      mikl $2a$14$bQ5MVsSFUuIJjHETVXzISOTy5SpLxRUlH6krxpzLH1.E0imi37Zb.
+      mikl $2a$14$ozHN9/aa4VhPX43NN8MKdODKvOoJ5MBpOUFhzkxwvb58ZI5b6eqEK
     }
   '';