diff --git a/docs/deployment.md b/docs/deployment.md
index daa6dd7..3b0ed05 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -102,7 +102,7 @@ Text-to-speech has not moved. piper on homesrv is the only synthesizer.
 | `mavpoll` | Environment poller: netdata alarms, uptime-kuma, zenmoney, wireguard presence. Writes facts, sends nothing. Telegram is `internal/delivery/telegramsink`. |
 | `mavcaldav` | CalDAV calendar sync. |
 | `mavmaild` | Mail reader (IMAP, read-only). Holds the IMAP password, core never sees it. |
-| `mavgpud` | GPU supervisor. **Runs on workpc**, own unit `deploy/mavgpud.service`. Keeps llama-server loaded while the card is free (V-488). Maven never asks it for anything and reads `/health` through `llm.Pair`. |
+| `mavgpud` | GPU supervisor. **Runs on workpc**, own unit `deploy/mavgpud.service`. Keeps llama-server loaded while the card is free (V-488). Maven never asks it for anything and reads `/health` through `llm.Pair`. Its LAN port needs a bearer token in the file named by `token_file`, matching `MAVEN_GPU_TOKEN` on homesrv, or it refuses to start (V-673). |
 | `mavupdate` | Not a daemon. Operator CLI a human runs on the box to deploy a new build. |
 
 Two binaries have no Makefile target and neither is deployed. `mavseal` encrypts
diff --git a/docs/offload.md b/docs/offload.md
index 922f709..f51fc1c 100644
--- a/docs/offload.md
+++ b/docs/offload.md
@@ -105,6 +105,19 @@ how we find out whether the blind spot is real.
 untouched. The model, the context size, the layer count and the MTP flags are the
 owner's business and not this daemon's schema.
 
+**The port carries a bearer token and cannot be loopback** (V-673). homesrv is
+the client, so this hop is on the LAN. Until 2026-08-11 anything on the network
+could spend the card, hold the model resident by touching the idle clock, and
+read `/slots`, which returns other callers' prompts. mavgpud now reads
+`token_file` and refuses to start when the listen address is reachable from the
+network without one. Downgrading to loopback instead would look safe and take
+the model arm down. Maven sends the same token from `workstation.token`, on the
+completion and on the `/health` probe alike. An unsigned probe answers 401,
+which Pair reads as a busy card, so a missing token degrades to the resident
+model rather than breaking a turn. The proxy also
+allowlists the five paths Maven calls, so a leaked token buys the model API and
+not llama-server's admin surface.
+
 **Every GPU service on that box belongs under this supervisor**, added to
 `cmd/mavgpud` rather than to systemd beside it. The rule was learned on
 2026-08-09. The CW2 transcriber ran as its own user unit and registered on the