diff --git a/public/admin/config.yml b/public/admin/config.yml
index 0aa3617..6b60b8a 100644
--- a/public/admin/config.yml
+++ b/public/admin/config.yml
@@ -1,14 +1,16 @@
-# Sveltia CMS config — backend: local Gitea (demo). Editors log in via Gitea OAuth
-# (PKCE, no client secret); edits are committed to the ctao/portal repo in Gitea.
-# Local-only setup: for phone demos switch base_url/api_root to a cloudflared
-# tunnel URL and update the OAuth redirect_uri + Gitea ROOT_URL accordingly.
+# Sveltia CMS config — backend: Gitea on the Cyfronet machine (demo). Editors
+# log in via Gitea OAuth (PKCE, no client secret); edits are committed to the
+# ctao/portal repo. localhost:3000 works both on the machine and through the
+# ssh -L tunnel (same port number keeps Gitea's ROOT_URL valid).
+# TODO(vhost): switch base_url/api_root to the public Gitea URL once the
+# ingress vhost exists (and update the OAuth app's redirect_uris + ROOT_URL).
 backend:
   name: gitea
   repo: ctao/portal
   branch: main
-  base_url: http://localhost:3010
-  api_root: http://localhost:3010/api/v1
-  app_id: 73c02331-8842-4ddc-b769-8b09c3c422fb
+  base_url: http://localhost:3000
+  api_root: http://localhost:3000/api/v1
+  app_id: cf1c44ac-ebe6-4a97-bf2f-f7f26ef1126c
 
 # CTAO branding on the CMS sign-in screen (official Decap/Sveltia option)
 logo_url: /brand/CTAO_Logo_login.svg