diff --git a/docs/product/passwords.md b/docs/product/passwords.md
index 3c96de3..491a81a 100644
--- a/docs/product/passwords.md
+++ b/docs/product/passwords.md
@@ -27,6 +27,7 @@
    - `himalaya` → IMAP/SMTP passwords via `secret-tool lookup email <addr>`
    - `ssh-agent` → SSH key passphrases via `secret-tool lookup ... ssh-key <path>`
    - `git-credential-libsecret` → Git passwords via libsecret
+     (github.com via `gh`, gitlab.satware.com via `glab`, **git.satware.ai via libsecret PAT**)
    - `JetBrains IDEs` → auto-detect D-Bus secrets service
 
 ## Quick Verification
@@ -42,6 +43,7 @@ rbw get "SSH Key: id_ed25519"  # should return "SSH gitlab.satware.com"
 # Can apps read secrets?
 secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
 secret-tool lookup application git service gitlab.satware.com
+secret-tool lookup server git.satware.ai protocol https user mw    # Gitea PAT (git-credential-libsecret schema)
 secret-tool lookup application nextcloud service cloud.satware.com user mw
 ```
 
@@ -51,7 +53,7 @@ secret-tool lookup application nextcloud service cloud.satware.com user mw
 |----------|---------|---------|
 | **SSH passphrases** | id_ed25519, id_ed25519_ja_manjaro | BW + GK |
 | **SSH host passwords** | b0t@192.168.0.141 | BW + GK |
-| **Git tokens** | GitLab PAT, GitHub token | BW + GK |
+| **Git tokens** | GitLab PAT, GitHub token, Gitea PAT (git.satware.ai) | GK (BW pending) |
 | **Remmina** | 5 VNC/RDP passwords | BW + GK |
 | **Nextcloud** | 3 instance passwords | BW + GK |
 | **Browser crypto** | Chrome, Brave, Chromium safe storage | BW + GK |
@@ -114,3 +116,13 @@ systemctl --user restart gnome-keyring-daemon.service  # if D-Bus secrets missin
 - Data file preserved at `~/.local/share/kwalletd/kdewallet.kwl` (backup)
 - PAM references already commented out
 - No longer used by any application
+
+## Gitea PAT (git.satware.ai)
+
+- Cached in gnome-keyring via `git credential approve` (schema `org.git.Password`, attributes: `protocol=https, server=git.satware.ai, user=mw`)
+- Git reads it via `credential.helper=libsecret` (global; no host-specific `store` override)
+- tea reads its own copy from `~/.config/tea/config.yml` (tea has no `auth git-credential` subcommand; file hardened to `chmod 600`)
+- Scopes: `write:repository`, `read:user`. Token lacks admin scope - **rotation must be done via web UI** at https://git.satware.ai/user/settings/applications
+- TODO (rotate): create new PAT with `write:repository, read:user, write:admin`; store in Bitwarden entry `Gitea PAT: git.satware.ai` + keyring + tea; revoke old token via API (now possible with admin scope); update this section
+- TODO (Bitwarden): create Bitwarden entry `Gitea PAT: git.satware.ai` (username `mw`, uri `https://git.satware.ai`) - blocked on rbw pinentry not supporting non-interactive password entry; create manually via `rbw add` or Bitwarden web UI
+- Tracked in Gitea issue #1: https://git.satware.ai/infrastructure/mw-pfeddersheim-workstation/issues/1