diff --git a/kubernetes/apps/trmnl/renderer.yaml b/kubernetes/apps/trmnl/renderer.yaml
index 88f47ea4..5c33db02 100644
--- a/kubernetes/apps/trmnl/renderer.yaml
+++ b/kubernetes/apps/trmnl/renderer.yaml
@@ -60,7 +60,7 @@ data:
         "rotate": null,
         "zoom": 1,
         "wait": null,
-        "theme": "trmnl-eink",
+        "theme": "Graphite E-ink Light",
         "lang": null,
         "dark": false,
         "invert": false,
@@ -142,9 +142,16 @@ spec:
         # proxy that exchanges a Terminus username+password for these
         # tokens, but that would mean shipping the Terminus PASSWORD
         # into the cluster and doing a network call at every pod start.
-        # Stock Terminus disables session expiry and issues effectively
-        # permanent tokens, so they are minted once out of band and kept
-        # in OpenBao — the password never enters the cluster.
+        # Tokens are therefore minted once out of band and kept in
+        # OpenBao — the password never enters the cluster.
+        #
+        # That only works because Terminus is configured with
+        # API_ACCESS_TOKEN_PERIOD = 10 years (see terminus.yaml). It is
+        # NOT, as an earlier version of this comment claimed, because
+        # stock Terminus issues permanent tokens — the stock default is
+        # 1800s, and this deployment demonstrated it by having the
+        # webhook start failing with "expired JWT access token" about
+        # thirty minutes after seeding.
         - name: render-schedule
           image: gitea.renner.uno/gitea_admin/alpine-jq:2026-07-30
           command: