diff --git a/src/pages/docs/configuration.astro b/src/pages/docs/configuration.astro
index a872ace..2ba0f2f 100644
--- a/src/pages/docs/configuration.astro
+++ b/src/pages/docs/configuration.astro
@@ -60,7 +60,7 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
         <tr>
           <td><code>OM_SMTP_HOST</code> / <code>OM_SMTP_PORT</code> / <code>OM_SMTP_FROM</code></td>
           <td>empty / <code>587</code> / empty</td>
-          <td>Optional. When set, adding an admin also emails the temporary password.</td>
+          <td>Optional. When set, adding an admin emails the temporary password, and the sign-in page can email a password-reset link. Set <code>OM_PUBLIC_URL</code> so that link is a full address.</td>
         </tr>
         <tr>
           <td><code>OM_SMTP_USERNAME</code> / <code>OM_SMTP_PASSWORD</code></td>
diff --git a/src/pages/docs/console.astro b/src/pages/docs/console.astro
index 6c16fbb..c87bdb5 100644
--- a/src/pages/docs/console.astro
+++ b/src/pages/docs/console.astro
@@ -46,6 +46,14 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     their own password at the next sign-in. Every signed-in account is an admin, and the last
     admin cannot be removed.
   </p>
+  <p>
+    When SMTP is configured, <strong>Forgot password?</strong> on the sign-in page emails a
+    link to that address. The link works once and expires in one hour. It sets a new password
+    and ends that admin's browser sessions. The page says the same thing whether or not the
+    address is an admin. Personal API tokens stay valid. Without SMTP, the link is not shown.
+    On the machine, <code>om admin reset-password --email you@example.com</code> sets a new
+    password instead. Set <code>OM_PUBLIC_URL</code> so the email contains a full address.
+  </p>
   <p>
     Google and GitHub buttons appear only when that provider is configured. Register
     <code>{'{OM_PUBLIC_URL}'}/auth/google/callback</code> or
diff --git a/src/pages/docs/kubernetes.astro b/src/pages/docs/kubernetes.astro
index 5a40a51..13720e2 100644
--- a/src/pages/docs/kubernetes.astro
+++ b/src/pages/docs/kubernetes.astro
@@ -79,7 +79,7 @@ helm install om deploy/helm/opensourceom \\
         <tr>
           <td><code>api.smtp.host</code> / <code>api.smtp.port</code> / <code>api.smtp.from</code></td>
           <td>empty / <code>587</code> / empty</td>
-          <td>Optional SMTP for temporary admin passwords. Setting the host requires <code>from</code>. A password stays in the chart Secret.</td>
+          <td>Optional SMTP for temporary admin passwords and password-reset links. Setting the host requires <code>from</code>. A password stays in the chart Secret.</td>
         </tr>
         <tr>
           <td><code>api.publicURL</code></td>
diff --git a/src/pages/docs/security.astro b/src/pages/docs/security.astro
index 7e3bad1..1ad2516 100644
--- a/src/pages/docs/security.astro
+++ b/src/pages/docs/security.astro
@@ -26,7 +26,8 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
   <p>
     <code>GET /v1/health</code>, <code>GET /v1/auth/session</code>,
     <code>POST /v1/auth/logout</code>, <code>POST /v1/auth/setup</code>,
-    <code>POST /v1/auth/login</code>, and <code>POST /v1/auth/totp</code> do not require a session.
+    <code>POST /v1/auth/login</code>, <code>POST /v1/auth/totp</code>,
+    <code>POST /v1/auth/forgot</code>, and <code>POST /v1/auth/reset</code> do not require a session.
     <code>GET /v1/admins</code>, <code>POST /v1/admins</code>,
     <code>POST /v1/admins/token</code>, and
     <code>DELETE /v1/admins/{'{id}'}</code> require a console session. A personal token cannot
@@ -49,7 +50,10 @@ import DocsLayout from '@/layouts/DocsLayout.astro';
     People sign in with an email and password. Every account is an admin. The first account is
     created from the setup form, or with <code>om admin create</code> before the port is
     reachable. <code>OM_ADMIN_EMAIL</code> pins that first address when you set it. Later admins
-    receive a temporary password and choose their own at the next sign-in. Passwords are stored
+    receive a temporary password and choose their own at the next sign-in. When SMTP is
+    configured, an admin can request a one-hour reset link. The response does not reveal
+    whether the address exists. The link works once, sets a new password, and ends that
+    admin's sessions. Personal API tokens stay valid. Passwords are stored
     as Argon2id hashes. Optional authenticator-app two-factor authentication is per admin.
     Sessions are httpOnly cookies. The cookie is marked <code>Secure</code> when
     <code>OM_PUBLIC_URL</code> uses <code>https</code>.