diff --git a/client/app/web/index.html b/client/app/web/index.html
index a49b314..24c2b97 100644
--- a/client/app/web/index.html
+++ b/client/app/web/index.html
@@ -32,10 +32,9 @@
   <title>KC-App</title>
   <link rel="manifest" href="manifest.json">
 
-  <!-- Firebase Cloud Messaging (web push). vapidKey still needs the Web Push
-       certificate key pair (Project settings > Cloud Messaging > Web config).
-       Until it's set kcGetPushToken() returns null and the app runs without
-       push. -->
+  <!-- Firebase Cloud Messaging (web push). `vapidKey` is the *public* half of
+       the Web Push certificate key pair; the private half stays in Firebase.
+       Backend sending still needs a service-account JSON + PUSH_PROVIDER=fcm. -->
   <script src="https://www.gstatic.com/firebasejs/10.13.2/firebase-app-compat.js"></script>
   <script src="https://www.gstatic.com/firebasejs/10.13.2/firebase-messaging-compat.js"></script>
   <script>
@@ -47,7 +46,7 @@
       messagingSenderId: "307226979593",
       appId: "1:307226979593:web:66898b2c78b2d110ef77d8",
       measurementId: "G-NK8K5VV40D",
-      vapidKey: "REPLACE_ME"
+      vapidKey: "BEAHrnIzkTBGSEws1J_HRvsTtc6nqvmW4MvFMTfljmjuunqo4yiJoUcq8_jKIt_hbm4diOt0czG28l-dpvGK8T8"
     };
     window.kcGetPushToken = async function () {
       try {