diff --git a/CONTEXT.md b/CONTEXT.md
index 7d6bda1..e64b411 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -22,7 +22,8 @@ Last updated: 2026-06-12 (storage UX polish)
 >   mounted-but-unregistered user-data drive (`POST /api/storage/register`); B4 per-card purpose
 >   descriptions + app-backing tags + tiering note (`local` & `local-lvm` both kept); B5 eject already
 >   names affected apps. All validated live on guest 9201.
-> - **Golden rebake NOT done** (no registry creds on `felhom-pve`); controller self-update covers drift.
+> - **Golden REBAKED** to controller 0.45.0 (`/root/build-golden.sh`; gitea allows anon pull, no creds);
+>   archive `local:backup/vzdump-lxc-9100-2026_06_12-09_53_03.tar.zst`, build guest 9100 purged.
 
 ---
 
diff --git a/REPORT.md b/REPORT.md
index 24883bf..5fa524e 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -64,9 +64,12 @@ no code change needed.
   check.
 - `go test ./...` green for the whole module.
 
-## Not done / human step
-- **Golden rebake** (to bake controller 0.45.0 into new-guest templates): NOT performed — `felhom-pve`
-  has no registry credentials (`REGISTRY_USER`/`REGISTRY_TOKEN`, stored out-of-band) and there is no
-  golden archive currently on the host. Controller **self-update covers the drift** (a freshly
-  provisioned guest would self-update to 0.45.0), so existing + new guests converge regardless. The
-  rebake remains a human/credentialed operational step.
+## Golden rebake — DONE
+- Rebaked on `felhom-pve` (the gitea registry allows anonymous pull — no creds needed):
+  `bash /root/build-golden.sh 9100 local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst local-lvm local
+  vmbr0 gitea.dooplex.hu/admin/felhom-controller:0.45.0`.
+- Verified the build guest baked `/etc/felhom-controller-image` = `…/felhom-controller:0.45.0` and the
+  docker image `…/felhom-controller:0.45.0` before archiving.
+- Golden archive: `local:backup/vzdump-lxc-9100-2026_06_12-09_53_03.tar.zst` (876 MB). Transient build
+  guest 9100 stopped + `pct destroy 9100 --purge`'d. New provisions now bring up controller 0.45.0
+  directly (self-update still covers any later drift).