diff --git a/.claude/skills/scadabridge-cluster-ops/SKILL.md b/.claude/skills/scadabridge-cluster-ops/SKILL.md
index 45e218ba..7c8deb24 100644
--- a/.claude/skills/scadabridge-cluster-ops/SKILL.md
+++ b/.claude/skills/scadabridge-cluster-ops/SKILL.md
@@ -6,6 +6,7 @@ description: How to drive the local ScadaBridge docker cluster — CLI managemen
 # ScadaBridge Cluster Ops (Docker / OrbStack)
 
 - **Management URL**: `http://localhost:9000` — the CLI connects via the Traefik load balancer, which routes to the active central node. Direct access: central-a on port 9001, central-b on port 9002.
+- **Central UI login is DISABLED on the rig (both central nodes, since 2026-09-06)** — `ScadaBridge:Security:Auth:DisableLogin=true` in `docker/central-node-{a,b}/appsettings.Central.json`, so `http://localhost:9000` (and 9001/9002) opens the UI as `multi-role` with every role, no LDAP login. The CLI/management API still takes `--username/--password` (Basic auth is a separate path), and `POST /auth/login` still answers 302, so the Playwright fixture login keeps working; only `LoginTests` (expects a `/login` redirect + 401 on bad credentials) fails against this rig. Flip the two keys back to `false` and recreate the node for real-login checks.
 - **Test user**: `--username multi-role --password password` — has Admin, Design, and Deployment roles. The `admin` user only has the Admin role and cannot create templates, data connections, or deploy.
 - **Config file**: `~/.scadabridge/config.json` — stores `managementUrl` and default format. See `docker/README.md` for a ready-to-use test config.
 - **Rebuild cluster**: `bash docker/deploy.sh` — builds the `scadabridge:latest` image and recreates all containers. Run this after code changes to ManagementActor, Host, or any server-side component.
diff --git a/docker/central-node-a/appsettings.Central.json b/docker/central-node-a/appsettings.Central.json
index b144142a..84df764d 100644
--- a/docker/central-node-a/appsettings.Central.json
+++ b/docker/central-node-a/appsettings.Central.json
@@ -44,7 +44,8 @@
         "_comment_ServiceAccountPassword": "Supplied as ScadaBridge__Security__Ldap__ServiceAccountPassword env override in docker-compose.yml (dev-only-insecure)."
       },
       "Auth": {
-        "DisableLogin": false,
+        "_comment": "RIG-ONLY: both central nodes run login-disabled so the local Central UI (http://localhost:9000 via Traefik, or 9001/9002 direct) needs no LDAP login. Dev/test only — the real login path is exercised by docker-env2 and the unit tests.",
+        "DisableLogin": true,
         "User": "multi-role"
       },
       "_comment_JwtSigningKey": "Supplied as ScadaBridge__Security__JwtSigningKey env override in docker-compose.yml (dev-only-insecure).",
diff --git a/docker/central-node-b/appsettings.Central.json b/docker/central-node-b/appsettings.Central.json
index dc0522f8..3108d798 100644
--- a/docker/central-node-b/appsettings.Central.json
+++ b/docker/central-node-b/appsettings.Central.json
@@ -44,7 +44,8 @@
         "_comment_ServiceAccountPassword": "Supplied as ScadaBridge__Security__Ldap__ServiceAccountPassword env override in docker-compose.yml (dev-only-insecure)."
       },
       "Auth": {
-        "DisableLogin": false,
+        "_comment": "RIG-ONLY: both central nodes run login-disabled so the local Central UI (http://localhost:9000 via Traefik, or 9001/9002 direct) needs no LDAP login. Dev/test only — the real login path is exercised by docker-env2 and the unit tests.",
+        "DisableLogin": true,
         "User": "multi-role"
       },
       "_comment_JwtSigningKey": "Supplied as ScadaBridge__Security__JwtSigningKey env override in docker-compose.yml (dev-only-insecure).",