diff --git a/README.md b/README.md
index 5b88408..7d58903 100644
--- a/README.md
+++ b/README.md
@@ -1284,8 +1284,9 @@ binaries and packages, pushes the image to GHCR and copies it to Docker Hub, upd
 Homebrew tap and the Scoop bucket, and deploys the apt, dnf and apk repositories to GitHub
 Pages. The workflow reads these repository secrets:
 
-- `DOCKERHUB_TOKEN`: a Docker Hub access token with Read & Write and no Delete, or an
-  organization token that can push only to `larvit/fejkdata`. The repository variable
+- `DOCKERHUB_TOKEN`: where `larvit` is a Docker Hub organization, an organization token
+  that can push only to `larvit/fejkdata`; otherwise a personal token with Read & Write and
+  no Delete, which reaches every repository the account can write. The repository variable
   `DOCKERHUB_USERNAME` names its account.
 - `PACKAGES_GPG_KEY`, `PACKAGES_RSA_KEY`: the private keys that sign the repositories.
 - `TAP_GITHUB_TOKEN`: a token that can push to `larvit/homebrew-tap` and
diff --git a/docs/decisions.md b/docs/decisions.md
index b2a56ef..c06346f 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -982,8 +982,10 @@ Valid while GitHub hosts the code.
 2026-10-14, decided by the maintainer. Serves goal 1.1; technical principle: prefer the
 vendor-neutral option (`~/.claude/principles/technical-principles.md`). Docker Hub is
 Docker's default registry, so `docker run larvit/fejkdata` works with no host in the name;
-that is a capability only Docker Hub has. GHCR stays the image's source: GoReleaser pushes
-there, and a job of its own copies the image to Docker Hub, so a Docker Hub failure holds up
-no other channel. GHCR also serves CI on shared runners, which Docker Hub's per-IP limit on
-anonymous pulls blocks. Leaving Docker Hub costs each user an edit of every `docker run` line
-and pinned script that names the bare `larvit/fejkdata`.
+that is a capability only Docker Hub has. GHCR stays the image's source, and adds no
+vendor while GitHub hosts the code; being OCI, the image moves to another registry by a
+change of path. GoReleaser pushes there, and a job of its own copies the image to Docker
+Hub, so a Docker Hub failure holds up no other channel. GHCR also serves CI on shared
+runners, which Docker Hub's per-IP limit on anonymous pulls blocks. Leaving Docker Hub
+costs each user an edit of every `docker run` line and pinned script that names the bare
+`larvit/fejkdata`.
\ No newline at end of file