diff --git a/wiki/decisions/appliance-provisioning.md b/wiki/decisions/appliance-provisioning.md
index 7a4e930..218225a 100644
--- a/wiki/decisions/appliance-provisioning.md
+++ b/wiki/decisions/appliance-provisioning.md
@@ -350,6 +350,12 @@ docker exec -it -e ADMIN_USER=admin -e ADMIN_PASS='<strong-pw>' \
   park-buzi-server-1 node scripts/seed-admin.mjs
 ```
 
+The container is named `<stack>-server-1` (compose project = the Komodo stack name: `park-2-server-1`
+on park-2; `docker ps` confirms). Leave `ADMIN_USER`/`ADMIN_PASS` off and the script prompts
+(Enter = `admin`) — preferred on a shared shell, the password never enters history. Idempotent: an
+existing username is left alone unless `FORCE=1` (§7e). After a `--users`/`--all` reset (§7d) run it
+again — it recreates the built-in `admin` role row the reset removes.
+
 > **Secrets-on-disk note.** The generated `.env` lands on the booth with **cleartext** secrets
 > (compose needs real values). That's why the disk is LUKS-encrypted (§3–4) and keys are per-booth
 > — the encryption is the control, and a single-booth compromise leaks only that booth's key. See
diff --git a/wiki/log.md b/wiki/log.md
index 594f880..54d7a71 100644
--- a/wiki/log.md
+++ b/wiki/log.md
@@ -3144,6 +3144,11 @@ run; the Quadro FX 3800 is unusable (cc 1.3), the HD P530 irrelevant, the Xeon E
 compose seam drops the GPU reservation; cloud GPU rejected (crops stay on premises). Linked from
 [[opencv-anpr-service]], [[vision-review-outbox]], index. User: "No build just yet."
 
+## [2026-09-07] query | How to seed the admin user on a booth
+Answered from [[appliance-provisioning]] §7b/§7e (`docker exec … node scripts/seed-admin.mjs`,
+`FORCE=1` to reset a password). One gap filled: the container-name pattern (`<stack>-server-1`,
+`park-2-server-1` on park-2), the prompting form, idempotence, and re-seeding after a reset.
+
 ## [2026-09-07] fix | reset-db drift — Car Wash tables and role_jobs were uncategorised
 User asked for "the command to reset everything in the booth pc". The documented command
 ([[appliance-provisioning]] §7d, `docker exec … reset-db.mjs --all`) would have been refused on