diff --git a/AGENTS.md b/AGENTS.md
index 6eabdfe..1bf6275 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -32,6 +32,11 @@ profiles, or override files. Containers: `api` (FastAPI :8000, attached),
 - Prod: own `.env` with secrets + `FRONTEND_MODE=preview`; code updates via
   `git pull` + restart, image rebuilds only for dependency changes
   (`docker compose up -d --build`).
+- Git in the container uses HTTPS with GCM (`credential.helper=manager`,
+  installed by `.devcontainer/setup.sh` together with `libicu76` runtime).
+  Remote URL has no embedded token. First push/pull triggers a device-code
+  prompt (open URL on host). Rotate GitLab tokens in GitLab UI before
+  switching credentials.
 
 ## Definition of done