diff --git a/114_koillection_deployment.md b/114_koillection_deployment.md
index cfcde2a..be7ef4b 100644
--- a/114_koillection_deployment.md
+++ b/114_koillection_deployment.md
@@ -1,6 +1,6 @@
 # 114 — Koillection Deployment Guide
 
-> Status: **IN PROGRESS** — CT created 2026-08-11, app + nginx + SSL + DNS live, Authelia decision + first login pending (Phase 9+)
+> Status: **IN PROGRESS** — CT created 2026-08-11, app + nginx + SSL + DNS live, Authelia bypassed by decision, first login pending (Phase 10+)
 > CT ID: 114 · IP: 192.168.1.114
 > Domain: `collections.spendlik.sk`
 > Last updated: 2026-08-11
@@ -311,7 +311,12 @@ Verified resolving via `nslookup collections.spendlik.sk` on CT 101 (canonical n
 
 ---
 
-## Phase 9 — Authelia Protection (CT 102)
+## Phase 9 — Authelia Protection (CT 102) — ❌ SKIPPED by decision (2026-08-11)
+
+**Decision: bypass Authelia, rely on Koillection's own login only.** Personal single-user instance — Koillection's built-in authentication is sufficient, and no Authelia middleware was ever added to the CT 101 nginx vhost (Phase 6), so there is nothing to add or remove. No `/etc/authelia/configuration.yml` changes were made for this domain.
+
+<details>
+<summary>Reference: steps to add Authelia later if this decision changes</summary>
 
 Enter CT 102, edit `/etc/authelia/configuration.yml`. Add to `access_control.rules`:
 
@@ -320,8 +325,6 @@ Enter CT 102, edit `/etc/authelia/configuration.yml`. Add to `access_control.rul
   policy: two_factor
 ```
 
-> Koillection has its own internal login system. Authelia adds a second layer before users even reach the login page. Since this is a personal single-user instance, you may prefer Authelia bypass and rely on Koillection's own login instead — your call.
-
 Restart Authelia after editing:
 
 ```bash
@@ -330,6 +333,8 @@ docker compose restart
 
 Add the Authelia middleware to the nginx vhost in CT 101 (follow the pattern from other protected services).
 
+</details>
+
 ---
 
 ## Phase 10 — First Login & Initial Setup
@@ -445,3 +450,4 @@ mkdir -p /opt/koillection/backups
 | `nginx: command not found` when following Phase 6 | You're inside CT 114 (koillection), not CT 101 (reverse-proxy). Check the shell prompt — nginx work always happens on CT 101, never on the app container itself |
 | Wrong nginx vhost filename | Use the full domain as the filename (`collections.spendlik.sk`), matching every other vhost on CT 101 — not the short service name |
 | certbot fails domain validation | DNS (Phase 8) must resolve publicly before certbot's HTTP-01 challenge (Phase 7) will succeed — do DNS first if it hasn't propagated yet |
+| No 2FA on collections.spendlik.sk | Intentional — Authelia was bypassed by decision (Phase 9). Security relies solely on Koillection's own login. Revisit if this ever becomes multi-user or exposed beyond personal use |