diff --git a/access.md b/access.md
index bb0b299..fcb5236 100644
--- a/access.md
+++ b/access.md
@@ -82,6 +82,14 @@ ssh -J sjat@makerfloss.eu:7576 -p 7576 sjat@10.13.0.3    # srv07
 
 First use on a fresh control node: accept/pin `makerfloss.eu`'s host key.
 
+Key state (2026-08-16): ubongo's `claude` key (`~/.ssh/id_ed25519.pub`,
+`claude@ubongo`) is appended to `~sjat/.ssh/authorized_keys` on **both the VPS
+and mf01** — done by hand via mamba, *not* via the users catalog in
+`AnsibleBaobabV4/group_vars/all/50-users_catalog.yml`, which still lists only
+the mamba + phone keys. A users-play run against those hosts will drop it again
+unless the catalog is updated first (TODO). Verified working end-to-end from
+ubongo the same day.
+
 ### C2. Via mamba (when mamba is at the makerspace)
 
 ubongo reaches mamba anywhere over the **boma wg hub** (`ssh mamba` =