diff --git a/kubernetes/infrastructure/image-automation/update-automation.yaml b/kubernetes/infrastructure/image-automation/update-automation.yaml
index f71e62b1..0719356d 100644
--- a/kubernetes/infrastructure/image-automation/update-automation.yaml
+++ b/kubernetes/infrastructure/image-automation/update-automation.yaml
@@ -8,8 +8,15 @@ spec:
   # Reuses the existing flux-system GitRepository — its Secret was
   # created by `flux bootstrap gitea --token-auth` and already has
   # write access to the repo. Push identity is the bootstrap token's
-  # owner (gitea_admin); commit author is overridden below to
-  # security-bot@renner.uno so commits stay visibly machine-authored.
+  # owner, which is the `flux` Gitea account (uid 9) — not
+  # gitea_admin, as this comment used to say. Evidence: the flux
+  # account's contribution history matches every
+  # `chore(image-automation)` commit on master 1:1, while
+  # gitea_admin's own contributions stop at 2026-07-21. That account
+  # therefore has to keep push access to master, or writeback fails
+  # silently — no commit is attempted unless a tracked image moves.
+  # The commit author overridden below to security-bot@renner.uno is
+  # the author field only; it says nothing about who pushes.
   sourceRef:
     kind: GitRepository
     name: flux-system