diff --git a/README.md b/README.md
index ee203da..f1d5fa6 100644
--- a/README.md
+++ b/README.md
@@ -51,25 +51,17 @@ The installer will offer to download the Ubuntu 22.04 template if missing.
 
 ## Run the installer (foundation)
 
-On the Proxmox host shell (as root):
+On the Proxmox host shell (as root). All repos are public, so no token needed:
 
-**Public repo:**
 ```bash
-bash <(curl -fsSL https://git.pterois.co.uk/jtr/proxmox-helpers/raw/branch/main/install-stack.sh)
-```
-
-**Private repo** (raw fetch needs the same token you'll paste into the wizard):
-```bash
-TOKEN=xxxxxxxx
-bash <(curl -fsSL -H "Authorization: token $TOKEN" \
-  https://git.pterois.co.uk/jtr/proxmox-helpers/raw/branch/main/install-stack.sh)
+bash <(curl -fsSL https://git.pterois.co.uk/jtr/proxmox-helpers-hotel-manage-stack/raw/branch/main/install-stack.sh)
 ```
 
 The wizard collects site name, domain, NPM LAN IP/gateway, office IP for
-offsite restriction, admin credentials, the Forgejo base URL + access token,
-and a backup target. It then provisions the six foundation LXCs (postgres,
-auth, portal, npm, management, noticeboard), health-checks each, and configures
-the NPM proxy routes.
+offsite restriction, admin credentials, the Forgejo base URL, and a backup
+target. It then provisions the six foundation LXCs (postgres, auth, portal,
+npm, management, noticeboard), health-checks each, and configures the NPM proxy
+routes. (Leave the Forgejo token blank — the repos are public.)
 
 Secrets are written to `/root/hnf-credentials.txt` (chmod 600) — copy this
 offsite.
@@ -79,15 +71,14 @@ offsite.
 On the Proxmox host (again, because it creates an LXC):
 
 ```bash
-bash <(curl -fsSL -H "Authorization: token $TOKEN" \
-  https://git.pterois.co.uk/jtr/proxmox-helpers/raw/branch/main/add-app.sh)
+bash <(curl -fsSL https://git.pterois.co.uk/jtr/proxmox-helpers-hotel-manage-stack/raw/branch/main/add-app.sh)
 ```
 
-Reads `/root/hnf-credentials.txt` for the shared secret, Forgejo token and
-office IP, provisions a new LXC, optionally creates a dedicated postgres DB,
-clones the app repo, and prints the NPM route / Uptime Kuma / webhook /
-deploy-map lines to finish wiring it in. After that, ongoing updates flow
-through the management container automatically.
+Reads `/root/hnf-credentials.txt` for the shared secret and office IP,
+provisions a new LXC, optionally creates a dedicated postgres DB, clones the
+app repo, and prints the NPM route / Uptime Kuma / webhook / deploy-map lines
+to finish wiring it in. After that, ongoing updates flow through the management
+container automatically.
 
 ## Replicating to another hotel
 
@@ -98,8 +89,8 @@ everywhere, so the repos are reused unchanged.
 
 ## Notes
 
-- The Forgejo token is embedded in each LXC's git remote URL so the management
-  updater can `git pull` on webhook without extra credentials. Use a
-  dedicated, least-privilege token (read:repository).
+- All repos are public, so no Forgejo token is needed to install or update.
+  The wizard still accepts a token (used only if you later make the repos
+  private again — it gets embedded in each LXC's git remote for the updater).
 - `install-stack.sh` is idempotent-ish: existing LXCs are skipped (started if
   stopped) rather than recreated, so a re-run resumes a partial install.
diff --git a/install-stack.sh b/install-stack.sh
index 9e3a996..5044876 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -7,7 +7,7 @@
 # │    bash install-stack.sh                                                │
 # │                                                                         │
 # │  Or from Forgejo once repos are pushed:                                 │
-# │    bash <(curl -fsSL https://git.pterois.co.uk/jtr/proxmox-helpers/raw/branch/main/install-stack.sh)
+# │    bash <(curl -fsSL https://git.pterois.co.uk/jtr/proxmox-helpers-hotel-manage-stack/raw/branch/main/install-stack.sh)
 # └─────────────────────────────────────────────────────────────────────────┘
 set -euo pipefail
 
@@ -137,13 +137,12 @@ Example: https://git.pterois.co.uk/jtr" \
 
   FORGEJO_TOKEN=$(whiptail --title "HNF Stack — Forgejo Token" \
     --passwordbox \
-"Access token for cloning private repos.
-Create in Forgejo: Settings → Applications → Generate Token
-(scope: read:repository). It is embedded in each LXC's git
-remote so the management updater can pull on webhook.
+"The repos are PUBLIC — leave this blank.
 
-Leave blank if the repos are public." \
-    13 66 3>&1 1>&2 2>&3) || exit 0
+(Only needed if you make them private again: an access token
+from Forgejo → Settings → Applications, scope read:repository,
+which gets embedded in each LXC's git remote for the updater.)" \
+    12 66 3>&1 1>&2 2>&3) || exit 0
 
   if whiptail --title "HNF Stack — Deploy Source" --yesno \
     "Deploy services from Forgejo? (recommended)\n\nNo = copy from a local repo at ${REPO_ROOT}\n(only works if you already copied the repo to this host)" \
@@ -789,7 +788,7 @@ SUMMARY
      Events: Push
 
   5. To add an app LXC later, on this host run:
-     bash <(curl -fsSL https://git.pterois.co.uk/jtr/proxmox-helpers/raw/branch/main/add-app.sh)
+     bash <(curl -fsSL https://git.pterois.co.uk/jtr/proxmox-helpers-hotel-manage-stack/raw/branch/main/add-app.sh)
 
 SUMMARY
 }