diff --git a/containers/adguard/adguard.config b/containers/adguard/adguard.config
index 5f284ef..8665b78 100755
--- a/containers/adguard/adguard.config
+++ b/containers/adguard/adguard.config
@@ -74,7 +74,5 @@ CFG_ADGUARD_PORT_5="adguard-service|dot|random:853|disabled|tcp|false|false|fals
 CFG_ADGUARD_PORT_6="adguard-exporter|metrics|9617:9617|disabled|tcp|false|false|false|Metrics Exporter (sidecar, docker-network only)|"
 
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_ADGUARD_AUTH_PROFILE=single_password
 CFG_ADGUARD_ADMIN_USER=
 CFG_ADGUARD_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD2
diff --git a/containers/bookstack/bookstack.config b/containers/bookstack/bookstack.config
index 4cc7fa7..09f9ad8 100644
--- a/containers/bookstack/bookstack.config
+++ b/containers/bookstack/bookstack.config
@@ -77,6 +77,4 @@ CFG_BOOKSTACK_NETWORK=default
 #
 CFG_BOOKSTACK_PORT_1="bookstack-service|webui|random:80|public|tcp|false|true|true|Web Interface||bookstack"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_BOOKSTACK_AUTH_PROFILE=multi_user
 CFG_BOOKSTACK_ADMIN_USER=
diff --git a/containers/gitea/gitea.config b/containers/gitea/gitea.config
index 572661d..8663099 100755
--- a/containers/gitea/gitea.config
+++ b/containers/gitea/gitea.config
@@ -67,8 +67,6 @@ CFG_GITEA_NETWORK=default
 CFG_GITEA_PORT_1="gitea-service|webui|random:3000|public|tcp|false|true|true|Web Interface||gitea"
 CFG_GITEA_PORT_2="gitea-service|ssh|random:22|private|tcp|false|false|false|Git SSH Access|"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_GITEA_AUTH_PROFILE=multi_user
 CFG_GITEA_ADMIN_USER=
 CFG_GITEA_ADMIN_EMAIL=
 #
diff --git a/containers/invidious/invidious.config b/containers/invidious/invidious.config
index 4285177..152f2c4 100755
--- a/containers/invidious/invidious.config
+++ b/containers/invidious/invidious.config
@@ -65,8 +65,6 @@ CFG_INVIDIOUS_NETWORK=default
 #
 CFG_INVIDIOUS_PORT_1="invidious-service|webui|random:3000|public|tcp|false|true|true|Web Interface||invidious"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_INVIDIOUS_AUTH_PROFILE=multi_user
 CFG_INVIDIOUS_ADMIN_USER=
 CFG_INVIDIOUS_ADMIN_EMAIL=
 #
diff --git a/containers/matrix/matrix.config b/containers/matrix/matrix.config
index 4f34eaa..4ca0929 100644
--- a/containers/matrix/matrix.config
+++ b/containers/matrix/matrix.config
@@ -115,5 +115,3 @@ CFG_MATRIX_NETWORK=default
 CFG_MATRIX_PORT_1="matrix-synapse|homeserver|random:8008|public|tcp|false|true|false|Matrix Homeserver (client + federation API)||matrix"
 CFG_MATRIX_PORT_2="matrix-element|webui|random:80|public|tcp|false|true|true|Element Web Interface||element"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_MATRIX_AUTH_PROFILE=multi_user
diff --git a/containers/mattermost/mattermost.config b/containers/mattermost/mattermost.config
index bc863dc..f401351 100644
--- a/containers/mattermost/mattermost.config
+++ b/containers/mattermost/mattermost.config
@@ -75,8 +75,6 @@ CFG_MATTERMOST_NETWORK=default
 #
 CFG_MATTERMOST_PORT_1="mattermost-service|webui|random:8065|public|tcp|false|true|true|Web Interface||mattermost"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_MATTERMOST_AUTH_PROFILE=multi_user
 # Email of the account the WebUI card advertises; set by whoever runs the setup
 # wizard or the create-account tool, and kept in step by the reset-password tool.
 CFG_MATTERMOST_ADMIN_EMAIL=
diff --git a/containers/nextcloud/nextcloud.config b/containers/nextcloud/nextcloud.config
index 120ae08..a7c85c5 100755
--- a/containers/nextcloud/nextcloud.config
+++ b/containers/nextcloud/nextcloud.config
@@ -29,7 +29,6 @@ CFG_NEXTCLOUD_DB_NAME=nextcloud
 CFG_NEXTCLOUD_DB_USER=nextcloud
 CFG_NEXTCLOUD_DB_PASSWORD_1=RANDOMIZEDPASSWORD2
 CFG_NEXTCLOUD_DB_ROOT_PASSWORD_1=RANDOMIZEDPASSWORD3
-CFG_NEXTCLOUD_AUTH_PROFILE=multi_user
 #
 # =============================================================================
 # METADATA
diff --git a/containers/rocketchat/rocketchat.config b/containers/rocketchat/rocketchat.config
index 9cb6673..8a8d885 100644
--- a/containers/rocketchat/rocketchat.config
+++ b/containers/rocketchat/rocketchat.config
@@ -76,5 +76,3 @@ CFG_ROCKETCHAT_NETWORK=default
 #
 CFG_ROCKETCHAT_PORT_1="rocketchat-service|webui|random:3000|public|tcp|false|true|true|Web Interface||rocketchat"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_ROCKETCHAT_AUTH_PROFILE=multi_user
diff --git a/containers/stalwart/stalwart.config b/containers/stalwart/stalwart.config
index 14478a6..794809e 100644
--- a/containers/stalwart/stalwart.config
+++ b/containers/stalwart/stalwart.config
@@ -117,12 +117,10 @@ CFG_STALWART_PORT_7="stalwart-service|pop3s|995:995|disabled|tcp|false|false|fal
 CFG_STALWART_PORT_8="stalwart-service|sieve|4190:4190|disabled|tcp|false|false|false|ManageSieve (client-managed mail filters)|"
 CFG_STALWART_PORT_9="stalwart-service|jmap|443:443|disabled|tcp|false|false|false|HTTPS/JMAP direct — leave disabled when Traefik fronts the UI|"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
 # The password reaches the container through a compose environment variable, so
 # if you replace the generated one by hand keep it alphanumeric: docker compose
 # interpolates `$` and YAML treats ` #` as a comment, either of which would
 # silently mangle the value. The generator only emits letters and digits.
-CFG_STALWART_AUTH_PROFILE=user_password
 CFG_STALWART_ADMIN_USER=admin
 CFG_STALWART_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD1
 #
diff --git a/containers/stoat/stoat.config b/containers/stoat/stoat.config
index c3fe048..3082eb5 100644
--- a/containers/stoat/stoat.config
+++ b/containers/stoat/stoat.config
@@ -95,7 +95,5 @@ CFG_STOAT_PORT_1="stoat-caddy|webui|random:80|public|tcp|false|true|true|Web Int
 # Not Traefik-managed — WebRTC is not HTTP.
 CFG_STOAT_PORT_2="stoat-livekit|voice-tcp|7881:7881|public|tcp|false|false|false|LiveKit voice/video (TCP fallback)|"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
 # Stoat exposes no safe way to set a password or grant a role from outside the
 # app, so these tools list and enable/disable only — see scripts/stoat_auth.sh.
-CFG_STOAT_AUTH_PROFILE=multi_user
diff --git a/containers/traefik/traefik.config b/containers/traefik/traefik.config
index 03b4c36..62b1922 100755
--- a/containers/traefik/traefik.config
+++ b/containers/traefik/traefik.config
@@ -85,6 +85,4 @@ CFG_TRAEFIK_PORT_1="traefik-service|dashboard|random:8080|public|tcp|true|true|t
 CFG_TRAEFIK_PORT_2="traefik-service|https|443:443|public|tcp|false|false|false|HTTPS Traffic|"
 CFG_TRAEFIK_PORT_3="traefik-service|http|80:80|disabled|tcp|false|false|false|HTTP Traffic|"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_TRAEFIK_AUTH_PROFILE=single_password
 CFG_TRAEFIK_ADMIN_USER=
diff --git a/scripts/app/auth_adapter.sh b/scripts/app/auth_adapter.sh
index d1214b0..bcba8b7 100644
--- a/scripts/app/auth_adapter.sh
+++ b/scripts/app/auth_adapter.sh
@@ -2,14 +2,17 @@
 
 # Universal user/credential adapter for app tools.
 #
-# Each app declares an auth profile in its config:
-#   CFG_<APP>_AUTH_PROFILE = single_password | user_password | multi_user | none
-#
-# And implements adapter functions in containers/<app>/scripts/<app>_auth.sh:
+# An app opts in by implementing adapter functions in
+# containers/<app>/scripts/<app>_auth.sh:
 #   authAdapter_<app>_setPassword "$user" "$password"
 #   authAdapter_<app>_createUser  "$user" "$password" "$email" "$isAdmin"
 #   authAdapter_<app>_listUsers
 #
+# What an app can do is discovered from which of those exist (authAdapterCanDo),
+# not declared anywhere. There used to be a CFG_<APP>_AUTH_PROFILE key naming a
+# capability tier, but nothing ever read it — it was a second source of truth
+# that could only drift out of step with the functions actually implemented.
+#
 # Tool wrappers call authAdapterCall <app> <method> <args...>. The
 # dispatcher checks the function exists, runs it, and refreshes apps.json
 # via webuiPatchAppConfigJson so new admin creds surface in the WebUI.