diff --git a/README.md b/README.md
index 20e42a0..7e0d136 100644
--- a/README.md
+++ b/README.md
@@ -16,10 +16,10 @@ Hybrid layout. The Gitea Actions trigger must live in the source repo (Gitea onl
 
 ```
 <source-repo>/
-  .gitea/workflows/<name>.yml       <- workflow: installs deps, clones this repo, runs renderer
+  .gitea/workflows/<name>.yml       <- workflow: clones this repo, runs renderer (deps pre-baked in job image)
 
 novoyuuparosk-auto-wiki/             <- this repo
-  .gitea/workflows/<pipeline>.yml    <- reusable workflow stubs (kept for reference; not actively called)
+  .gitea/workflows/<pipeline>.yml    <- reusable workflow stubs (kept for reference; not actively called; may be stale)
   pipelines/<pipeline>/              <- per-pipeline code, schema, templates
   lib/                               <- shared modules (MediaWiki client, etc.)
 ```
@@ -33,12 +33,9 @@ Note: `workflow_call` across private repos was abandoned — the auto-generated
 
 ## Bot identity
 
-MediaWiki BotPassword issued for user `Dubrowski`, bot name `giteaAutomaton`.
+MediaWiki BotPassword issued for user `Dubrowski`, bot name `giteaAutomaton`. Login form: `Dubrowski@giteaAutomaton`.
 
-Login as `Dubrowski@giteaAutomaton` with password `d8jua48t65jgjp3dfcqhfg7257tri6ui`.
-(Legacy form: username `Dubrowski`, password `giteaAutomaton@d8jua48t65jgjp3dfcqhfg7257tri6ui`.)
-
-Plaintext here is acceptable for the current phase (private repo, home-Pi LAN-only Gitea). Rotate before any of those preconditions change. Note that `git log` retains this string forever, so rotation requires a wiki-side BotPassword regeneration regardless of what happens to this file.
+Credentials are stored in the Gitea user-scope secret vault under `mikkeli` (`WIKI_BOT_USER`, `WIKI_BOT_PASSWORD`). Not stored in this repo.
 
 ## Runner infrastructure
 
diff --git a/pipelines/songs/README.md b/pipelines/songs/README.md
index 6c831cf..94be2e8 100644
--- a/pipelines/songs/README.md
+++ b/pipelines/songs/README.md
@@ -58,9 +58,9 @@ Triggers:
 
 ## Dependencies
 
-- Python 3.12+ (job container: `python:3.12-slim`)
-- Pandoc (apt-installed in the job container)
-- `python-frontmatter`, `mwclient`, `PyYAML` — see `requirements.txt`
+Job container: `novoyuuparosk-wiki-runner:latest` (pre-built, stored in the local Docker daemon on the runner host). Bakes in Python 3.12, Pandoc, and all pipeline Python packages — no install steps at job runtime.
+
+See the `Dockerfile` at the repo root and `requirements.txt` in this directory. Rebuild the image after changes to either.
 
 ## Modes