diff --git a/apps/web/PRODUCT.md b/apps/web/PRODUCT.md
index 84caac947..c0ab4fc0c 100644
--- a/apps/web/PRODUCT.md
+++ b/apps/web/PRODUCT.md
@@ -42,8 +42,8 @@ workbench.
 
 - Paired console (`services/core-console`): the administrator signs in with the
   deployment's Core key, the administration credential the installer writes to
-  `admin/core.key` under the installation directory (by default
-  `~/.parsar/core/admin/core.key`; keeping and rotating it is described in
+  `secrets/core.key` under the installation directory (by default
+  `~/.parsar/core/secrets/core.key`; keeping and rotating it is described in
   [Core key](../../docs/getting-started/operations.md#core-key)). There are no
   console accounts or usernames. The browser sends the key only to sign in and
   keeps only the session cookie; the console server holds the Core key and forwards
diff --git a/apps/web/src/features/first-run/ConsoleAccess.tsx b/apps/web/src/features/first-run/ConsoleAccess.tsx
index 98a99235d..8c1f7cf6d 100644
--- a/apps/web/src/features/first-run/ConsoleAccess.tsx
+++ b/apps/web/src/features/first-run/ConsoleAccess.tsx
@@ -15,7 +15,7 @@ import "./console-access.css";
  * directory, and that file under the default installation directory. The
  * sign-in help names both.
  */
-const CORE_KEY_LOCATION = { file: "admin/core.key", defaultPath: "~/.parsar/core/admin/core.key" } as const;
+const CORE_KEY_LOCATION = { file: "secrets/core.key", defaultPath: "~/.parsar/core/secrets/core.key" } as const;
 
 const ConsoleAccountContext = createContext<{ logout: () => Promise<void> } | null>(null);
 export const useConsoleAccount = () => useContext(ConsoleAccountContext);
diff --git a/docs/web/core-connection.md b/docs/web/core-connection.md
index 5447ff724..e774c962c 100644
--- a/docs/web/core-connection.md
+++ b/docs/web/core-connection.md
@@ -40,8 +40,8 @@ application's caller-managed `self_hosted` Runtime, including its own E2B setup.
 
 The console exposes `GET /console/auth` and `POST /console/auth/login` and
 `/logout`. The administrator signs in with the deployment's Core key, which the
-installer writes to `admin/core.key` under the installation directory (by default
-`~/.parsar/core/admin/core.key`; see [Core key](../getting-started/operations.md#core-key)).
+installer writes to `secrets/core.key` under the installation directory (by default
+`~/.parsar/core/secrets/core.key`; see [Core key](../getting-started/operations.md#core-key)).
 The server compares it in constant time and answers with a same-origin session
 cookie held only in its memory; the key is never logged or returned, and the
 browser does not store it. A console restart or a Core key rotation requires