diff --git a/nix/modules/acme-dns.nix b/nix/modules/acme-dns.nix
index e5a6db5..6dae23d 100644
--- a/nix/modules/acme-dns.nix
+++ b/nix/modules/acme-dns.nix
@@ -27,9 +27,9 @@ let
     ip = "127.0.0.1"
     port = "8080"
     tls = "none"
-    # Bootstrap registration is deliberately temporary. Once the single Lego
-    # account exists, change this to true in a follow-up reviewed deployment.
-    disable_registration = false
+    # The one Lego account was bootstrapped before this configuration was
+    # hardened. Updates authenticated by that account remain available.
+    disable_registration = true
     corsorigins = []
 
     [logconfig]