diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml
index 2d3ed3a..612258c 100644
--- a/.forgejo/workflows/deploy.yaml
+++ b/.forgejo/workflows/deploy.yaml
@@ -105,7 +105,7 @@ jobs:
           SOURCE: "docker-compose.yml"
           TARGET: "/opt/datacenterbingo/"
 
-      # Read-only DB role and MinIO user (see CLAUDE.md); the asxp.io admin
+      # Read-only DB role and S3 key (see CLAUDE.md); the asxp.io admin
       # owns writes. BINGO_HOST also feeds the Traefik rule via compose.
       - name: Deploy .env from secrets
         uses: appleboy/ssh-action@v1.2.3
diff --git a/CLAUDE.md b/CLAUDE.md
index 3144525..a8c8b1c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -20,8 +20,8 @@ Content is edited in the asxp.io admin (`/admin/bingo`, repo `asxpio`:
   admin side (writes, photo upload and resizing, IndexNow pings, ranking,
   seeding, `guess_provider`) stays in asxpio. Keep shared parts in step:
   `PROVIDERS`, `Board`, and model methods.
-- Prod uses a read-only DB role `bingo` (SELECT on the two tables) and a
-  MinIO user limited to `s3:GetObject` on `datacenterbingo-photos`. Both
+- Prod uses a read-only DB role `bingo` (SELECT on the two tables) and an
+  S3 key (Garage) that can only read `datacenterbingo-photos`. Both
   are provisioned by the `storage` repo (`init/`), from the same
   `BINGO_*` secrets set on both repos.
 
@@ -85,5 +85,5 @@ Secrets:
 | `FJ_REGISTRY`, `FJ_USER`, `FJ_TOKEN` | kaniko clone + push (`write:package`, `read:repository`); Forgejo reserves the `FORGEJO_` prefix |
 | `DEPLOY_IP`, `DEPLOY_USER`, `DEPLOY_SSH_KEY` | SSH to prod |
 | `BINGO_DB_PASSWORD` | read-only Postgres role `bingo` |
-| `BINGO_S3_ACCESS_KEY`, `BINGO_S3_SECRET_KEY` | read-only MinIO user |
+| `BINGO_S3_ACCESS_KEY`, `BINGO_S3_SECRET_KEY` | read-only S3 key; the deploy hashes it into Garage's key format, as storage does |
 | `INDEXNOW` | same key as asxpio's `INDEXNOW` (served here, pinged from there) |
diff --git a/docker-compose.yml b/docker-compose.yml
index ae01489..f99f786 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,7 +8,7 @@ services:
     env_file: .env
     networks:
       - traefik
-      - storage # postgres + minio
+      - storage # postgres + garage (S3)
     labels:
       - "traefik.enable=true"
       # Priority beats the old asxpio-bingo router while both exist.
diff --git a/lib/bingo.rb b/lib/bingo.rb
index 635df03..52cbc1b 100644
--- a/lib/bingo.rb
+++ b/lib/bingo.rb
@@ -299,7 +299,7 @@ module Bingo
     end
   end
 
-  # Photos live in the asxpio MinIO bucket under bingo/ (uploaded and resized
+  # Photos live in the datacenterbingo-photos bucket under bingo/ (uploaded and resized
   # by the asxp.io admin) and are proxied here, so the bucket stays private.
   module Photo
     PREFIX  = 'bingo/'.freeze