diff --git a/DEPLOY.md b/DEPLOY.md
index 9a29a57..275783b 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -1,6 +1,6 @@
# Deploy CA Lab Studio
-Deploy `glitch_voxel_automata_lab`, not `glitch_voxel_automata`.
+Deploy this CA Lab Studio app into `/opt/glitch_automata_lab` on the server.
This app is the CA Lab Studio service:
@@ -8,6 +8,42 @@ This app is the CA Lab Studio service:
- React admin app at `/admin`
- React viewer/recorder routes at `/view/*`
- Postgres database via `DATABASE_URL`
+- Cross-subdomain lab access via the shared gnommoweb `auth_token` JWT cookie
+
+## Lab Access
+
+In production, the lab expects gnommoweb to be the identity issuer:
+
+```env
+JWT_SECRET=... # same value as gnommoweb
+LAB_AUTH_ENABLED=true
+LAB_KEYCARD_REQUIRED=true
+GNOMMOWEB_URL=https://glitch.university
+LAB_KEYCARD_MERIT_SLUG=lab-keycard
+LAB_USER_PROFILE_URL=https://glitch.university/api/user/profile
+LAB_SIGN_IN_URL=https://glitch.university/auth/google?returnTo={returnTo}
+```
+
+The gnommoweb side should set `auth_token` with `Domain=.glitch.university`
+and expose `LAB_USER_PROFILE_URL`. Access is granted immediately if the verified
+JWT contains:
+
+```json
+{ "merit_slug": "lab-keycard" }
+```
+
+If the JWT does not contain that claim, the lab calls the user profile endpoint
+with the same `auth_token` cookie and expects the profile to include:
+
+```json
+{
+ "merits": [
+ { "slug": "lab-keycard" }
+ ]
+}
+```
+
+Local development keeps auth disabled unless `LAB_AUTH_ENABLED=true` is set.
## Build
diff --git a/backend/admin/src/main.tsx b/backend/admin/src/main.tsx
index efe2fef..7c1a16e 100644
--- a/backend/admin/src/main.tsx
+++ b/backend/admin/src/main.tsx
@@ -33,6 +33,7 @@ const SKIN_STORAGE_KEY = 'ca-studio-skin'
const GALLERY_TAB_STORAGE_KEY = 'ca-studio-gallery-tab'
const ENGINE_DIMENSION_STORAGE_KEY = 'ca-studio-engine-dimension'
const ICG_DIMENSION_STORAGE_KEY = 'ca-studio-icg-dimension'
+const DEFAULT_SKIN = 'windows-95'
const SKINS = [
{ id: 'retro-crt', label: 'Retro CRT' },
@@ -571,7 +572,7 @@ function App() {
const [route, setRoute] = React.useState(routeFromLocation)
const [skin, setSkin] = React.useState