diff --git a/traefik/README.md b/traefik/README.md
index 5feef84..981bfc6 100644
--- a/traefik/README.md
+++ b/traefik/README.md
@@ -92,17 +92,16 @@ provider starts. The only errors are ACME issuance failures — **expected**, be
 
 ---
 
-## ⚠️ Before cutover — two prerequisites
+## Before cutover — prerequisites (both satisfied 2026-08-26)
 
-**1. Port 80 must be NAT'd to the docker host (`192.168.0.9`).** It is currently pointed at
-**Exchange** (`192.168.0.6`) — repointed by hand on 2026-08-26 so win-acme could renew. Traefik's
-`exchange-acme` router is what replaces that manual step permanently, but it can only do so if `:80`
-arrives at Traefik. **Move it back to `192.168.0.9` as part of the cutover.**
+**1. Port 80 NAT → docker host (`192.168.0.9`) — done 2026-08-26.** Verified: `:80` is answered by
+the docker host. This is what lets `exchange-acme` replace the manual NAT repoint that every past
+Exchange renewal has needed. **Do not point `:80` back at Exchange** — it would break the L7
+redirect and is no longer necessary.
 
-**2. `traefik.shcnw.ru` has no DNS record.** The dashboard router is shipped **commented out** for
-that reason — ACME validates from the internet even for a LAN-only router. Create
-`traefik.shcnw.ru A 217.15.22.194`, then uncomment the router (hot-reloads, no restart). The
-htpasswd is already staged.
+**2. `traefik.shcnw.ru` DNS — done 2026-08-26** (`A 217.15.22.194`), so the dashboard router is
+enabled. Note the general rule: a LAN-only router still needs a **public** A-record, because ACME
+validates from the internet; `ipAllowList` gates *access*, not issuance.
 
 ---
 
diff --git a/traefik/dynamic/services.yml b/traefik/dynamic/services.yml
index 18dc9fb..c51f840 100644
--- a/traefik/dynamic/services.yml
+++ b/traefik/dynamic/services.yml
@@ -144,17 +144,15 @@ http:
       service: cockpit
       middlewares: [lan-only]
       tls: { certResolver: le }
-    # ---- Traefik dashboard: DISABLED until DNS exists ----
-    # `traefik.shcnw.ru` is NXDOMAIN as of 2026-08-26. ACME (TLS-ALPN, like HTTP-01)
-    # validates from the internet, so a public A-record -> 217.15.22.194 is required
-    # even though the router is LAN-only. Create the record, then uncomment — this
-    # file hot-reloads, no restart needed. The htpasswd is already staged on the host.
-    # dashboard:
-    #   entryPoints: [websecure]
-    #   rule: "Host(`traefik.shcnw.ru`)"
-    #   service: api@internal
-    #   middlewares: [lan-only, dash-auth]
-    #   tls: { certResolver: le }
+    # ---- Traefik dashboard (LAN-only + basic-auth) ----
+    # Needs a PUBLIC A-record even though access is LAN-only, because ACME validates
+    # from the internet. traefik.shcnw.ru -> 217.15.22.194 created 2026-08-26.
+    dashboard:
+      entryPoints: [websecure]
+      rule: "Host(`traefik.shcnw.ru`)"
+      service: api@internal
+      middlewares: [lan-only, dash-auth]
+      tls: { certResolver: le }
 
   # ===========================================================================
   # Services (backends) — mirror the NPM proxy-host forward targets