diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee0ec9f..b9d4b93 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,6 @@
+## v1.19.1
+- docs: README.md and docs/architecture.md described host-access authorization as a client-side loop over each of a user's LDAP groups (`GET /api/discovery/resources?group=<cn>` per group). The actual code (`utils/access.js`, `accessibleHosts()`) makes one call to the SSO's `GET /api/discovery/access/:uid`, which resolves the user's groups server-side. Corrected both.
+
 ## v1.19.0
 - fix: **only catalog hosts are jump targets.** `isManagedHost` treated a missing `metadata.managed` flag as permission, so any host the SSO merely *discovered* — an unpromoted Proxmox guest, a UniFi client — was offered in the TUI picker and accepted by the username grammar. The filter is now `isCatalogHost`, mirroring the SSO Directory's own rule: a resource carrying `discovery_sources` but never promoted is excluded, while hand-created hosts (no `discovery_sources`) and promoted ones (`managed: true`) are included, and an explicit `managed: false` is always excluded.
 - test: regression coverage for all five cases (hand-made, discovered-unpromoted, discovered-promoted, `manual` source, explicitly unmanaged).
diff --git a/README.md b/README.md
index 77298a0..a9f47b7 100644
--- a/README.md
+++ b/README.md
@@ -37,9 +37,10 @@ bridged straight in.
    jump host's own injected key excluded) or password (LDAP bind; the
    `ssh.passwordAuth` policy can restrict passwords to local clients or disable
    them — keys-only is recommended for a public host).
-2. **Authorization** — the hosts you may reach are the union of your LDAP groups
-   × the SSO directory (`/api/discovery/resources?group=<cn>`). No directory
-   entry, no access.
+2. **Authorization** — the jump host calls the SSO Manager's
+   `GET /api/discovery/access/:uid` once per user; the SSO evaluates the
+   user's LDAP group memberships server-side and returns their full access
+   projection in one response. No directory entry, no access.
 3. **Key injection** — on first use the jump host appends its own public key to
    your `sshPublicKey` in LDAP (comment-marked), then connects downstream **as
    you** using its private key. Downstream hosts already serve keys from LDAP
diff --git a/docs/architecture.md b/docs/architecture.md
index 8104ee1..7f00b75 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -41,11 +41,13 @@ Every attempt — success or failure, with method and reason — is audited.
 ## 2. Access & target resolution
 
 The hosts a user may reach are computed from the directory, not a local list:
-
-1. The user's LDAP group memberships (`(&(objectClass=groupOfNames)(member=…))`).
-2. For each group, the SSO's
-   `GET /api/discovery/resources?group=<cn>` (authenticated with an API token),
-   unioned and filtered to `kind: host`.
+the jump host calls the SSO's `GET /api/discovery/access/:uid` (authenticated
+with an API token) once per user; the SSO evaluates the user's LDAP group
+memberships server-side and returns the full access projection in one
+response, already filtered to `kind: host`. (The jump host also has an
+admin-only `allHosts()` path, used for the unfiltered catalog listing, which
+does call `GET /api/discovery/resources?group=<cn>` per group — but that's
+not the per-user authorization path.)
 
 Each host's dial address is `metadata.ip` (or the hostname from
 `metadata.address`) and port `metadata.sshPort` (default 22). Results are cached
diff --git a/docs/images/audit.png b/docs/images/audit.png
index 997974d..ac77188 100644
Binary files a/docs/images/audit.png and b/docs/images/audit.png differ
diff --git a/docs/images/dashboard.png b/docs/images/dashboard.png
index 8caa276..40bb6fb 100644
Binary files a/docs/images/dashboard.png and b/docs/images/dashboard.png differ
diff --git a/docs/images/login.png b/docs/images/login.png
index 5881ac9..718c264 100644
Binary files a/docs/images/login.png and b/docs/images/login.png differ
diff --git a/docs/images/sessions.png b/docs/images/sessions.png
index e52511c..a9129a7 100644
Binary files a/docs/images/sessions.png and b/docs/images/sessions.png differ
diff --git a/nodejs/package-lock.json b/nodejs/package-lock.json
index 2f7cf78..f8c07b5 100644
--- a/nodejs/package-lock.json
+++ b/nodejs/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "t42-jump-host",
-  "version": "1.19.0",
+  "version": "1.19.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-jump-host",
-      "version": "1.19.0",
+      "version": "1.19.1",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
diff --git a/nodejs/package.json b/nodejs/package.json
index 5ab0a16..68758e1 100644
--- a/nodejs/package.json
+++ b/nodejs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "t42-jump-host",
-  "version": "1.19.0",
+  "version": "1.19.1",
   "description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
   "author": [
     {