diff --git a/.env.example b/.env.example
index 9e5d404..872e8be 100644
--- a/.env.example
+++ b/.env.example
@@ -25,8 +25,8 @@ IMGPROXY_KEY=
 IMGPROXY_SALT=
 
 # Auth — Authelia Remote-User trust
-# Comma-separated groups allowed to access admin (empty = any authenticated user)
-ADMIN_GROUPS=lldap_admin,admin,portfolio_admin
+# Comma-separated usernames allowed for admin (groups ignored)
+ADMIN_USERS=jmartin
 # When true, require Remote-User header for /api/v1/admin/* (disable only for local dev)
 REQUIRE_REMOTE_USER=true
 
diff --git a/server/src/config.ts b/server/src/config.ts
index 3624d19..59642cc 100644
--- a/server/src/config.ts
+++ b/server/src/config.ts
@@ -44,7 +44,8 @@ export const config = {
     key: env("IMGPROXY_KEY", ""),
     salt: env("IMGPROXY_SALT", ""),
   },
-  adminGroups: env("ADMIN_GROUPS", "lldap_admin,admin,portfolio_admin")
+  /** Comma-separated usernames allowed for admin (groups ignored). */
+  adminUsers: env("ADMIN_USERS", "jmartin")
     .split(",")
     .map((s) => s.trim())
     .filter(Boolean),
diff --git a/server/src/lib/auth.ts b/server/src/lib/auth.ts
index 988b619..1cf39bd 100644
--- a/server/src/lib/auth.ts
+++ b/server/src/lib/auth.ts
@@ -31,9 +31,10 @@ export function getRemoteUser(req: FastifyRequest): AuthUser | null {
   };
 }
 
+/** Allow only configured usernames (default: jmartin). Groups are ignored. */
 export function isAdminUser(user: AuthUser): boolean {
-  if (config.adminGroups.length === 0) return true;
-  return user.groups.some((g) => config.adminGroups.includes(g));
+  const name = user.username.trim().toLowerCase();
+  return config.adminUsers.some((u) => u.toLowerCase() === name);
 }
 
 /** Dev bypass when REQUIRE_REMOTE_USER=false */
@@ -41,16 +42,19 @@ export function requireAdmin(req: FastifyRequest, reply: FastifyReply): AuthUser
   const user = getRemoteUser(req);
   if (user) {
     if (!isAdminUser(user)) {
-      reply.code(403).send({ error: "Forbidden", message: "Insufficient group membership" });
+      reply.code(403).send({
+        error: "Forbidden",
+        message: `User “${user.username}” is not authorized for admin.`,
+      });
       return null;
     }
     return user;
   }
   if (!config.requireRemoteUser) {
     return {
-      username: "dev-admin",
+      username: config.adminUsers[0] || "jmartin",
       name: "Dev Admin",
-      groups: config.adminGroups.length ? [config.adminGroups[0]] : ["admin"],
+      groups: [],
     };
   }
   reply.code(401).send({