diff --git a/TODO.AI.md b/TODO.AI.md
index f257a34..4933d10 100644
--- a/TODO.AI.md
+++ b/TODO.AI.md
@@ -23,8 +23,8 @@
   deprecated `[webhook]` key is moved to `[security]`), `[migrations]` host list and `EGRESS_MODE` are
   added only when missing. Dead keys are left in place (ignored by Gitea).
 - Verified with the real image: a fresh install and an upgrade of a real customised config both start with
-  zero `[E]` and, for the upgrade, zero warnings. Kept on purpose: `DISABLE_QUERY_AUTH_TOKEN = false` (an
-  earlier deliberate pin) so a fresh install still logs its one warning.
+  zero `[E]` and, for the upgrade, zero warnings. `DISABLE_QUERY_AUTH_TOKEN = false` pin removed at the
+  owner's request (28 still defaults to false, so no behaviour change; the startup warning is gone).
 - Behaviour now actually in effect (was silently ignored before): `[migrations] SKIP_TLS_VERIFY = true`
   and migrations/mirrors may reach private and loopback hosts. Needs the owner's confirmation.
 
diff --git a/rootfs/tmp/etc/gitea/app.ini b/rootfs/tmp/etc/gitea/app.ini
index 99c443d..90d20f7 100644
--- a/rootfs/tmp/etc/gitea/app.ini
+++ b/rootfs/tmp/etc/gitea/app.ini
@@ -198,11 +198,6 @@ REVERSE_PROXY_AUTHENTICATION_FULL_NAME                     = X-WEBAUTH-FULLNAME
 X_FRAME_OPTIONS                                            = SAMEORIGIN
 ALLOWED_HOST_LIST                                          = private,loopback
 EGRESS_MODE                                                = lax
-; explicit: defaults to true starting Gitea 1.23 and deprecates ?token=/?access_token=
-; auth entirely in 1.24 — pin false so query-token API calls keep authenticating on
-; upgrade instead of silently downgrading to anonymous; migrate callers to
-; "Authorization: token <token>" when convenient
-DISABLE_QUERY_AUTH_TOKEN                                   = false
 ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [time]
 DEFAULT_UI_LOCATION                                        = REPLACE_TZ