diff --git a/project-kitestacks-migration.md b/project-kitestacks-migration.md
index a39ab51..00d5715 100644
--- a/project-kitestacks-migration.md
+++ b/project-kitestacks-migration.md
@@ -607,6 +607,9 @@ Connectivity note:
   public/tunneled Prometheus endpoint.
 - The existing KiteStacks docs mark Prometheus as excluded from the Cloudflare
   tunnel, so there is no known public Prometheus URL to target yet.
+- The desktop widget script now defaults to `https://prometheus.kitestacks.com`
+  and can send `CF-Access-Client-Id` / `CF-Access-Client-Secret` headers if the
+  hostname is protected by Cloudflare Access.
 
 Important security hygiene: local git remote for `~/claude-memory` contains an
 HTTP token in the URL; do not print it in summaries. Prefer redacted URLs in