diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b9f6fc..d2de529 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,15 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-13 — My account `web 0.181.0`
+
+**Settings in the account menu is now My account**, at `/account`: your profile and how you sign
+in. It stays inside the app you opened it from, so opening it from the Admin Center no longer drops
+you into the RMM. The old `/settings` addresses, including links in mails already sent, still land
+on the right page.
+
+Update the web image. No API or agent update is required.
+
 ## 2026-10-13 — Platform roles and organization roles `api 0.148.0` `web 0.180.0`
 
 **Two kinds of role, each with one name.** A **platform role** says what an account may do on the
diff --git a/README.md b/README.md
index a311e18..c9faddb 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,7 @@ inside those numbers — every connector, the agent, the remote terminal, the as
 licence from your provider raises the limits and can include an optional managed model; it switches
 nothing in Jarvis on or off.
 
-When you outgrow it, **ask for a licence from inside Jarvis** — Settings → Licence — and the key
+When you outgrow it, **ask for a licence from inside Jarvis** — Admin Center → Licence — and the key
 arrives on your instance by itself. A community instance reports its version and its counts so that
 we can see which builds are in the field; [what it sends](#licence-keys-and-what-your-instance-reports)
 is listed in full below.
@@ -328,7 +328,7 @@ where you answer it — **it shows you the chain your own request actually carri
 API resolved from it**, so you confirm what you see rather than counting hops from memory. That is
 what puts real client addresses in the audit trail and the session list instead of your proxy's, and
 setting it too high is the dangerous direction: the API would then believe that many hops of a
-header a caller can forge. Change it later under **Settings → Platform**.
+header a caller can forge. Change it later under **Admin Center → Settings → Address**.
 
 ## Upgrading
 
@@ -388,8 +388,8 @@ runs; the agent changes what runs on every machine you administer. Pinning the i
 build your instance publishes; a separate **update policy** decides when a machine takes it —
 *As soon as available*, *On a schedule*, *Manually only*, *Let the agent decide* (the default, which
 means on its next service start, and on a server that can be months) or *Never*. The instance-wide
-answer is on **Settings → Platform → General**; an organization overrides it under **Settings →
-Organization → Agent updates**, and a single machine overrides that. An enrolled agent also refuses
+answer is on **Admin Center → Settings → Machines**; an organization overrides it under
+**Admin Center → Organizations → *your organization* → Policies**, and a single machine overrides that. An enrolled agent also refuses
 any version that is not strictly newer, so moving that pin back stops a rollout rather than reversing
 it on machines that already took the update.
 
@@ -413,7 +413,7 @@ COMPOSE_FILE=docker-compose.yml:docker-compose.agent.yml
 then `docker compose pull && docker compose up -d`. A one-shot `agent-releases` service copies the
 release into a volume the api reads, and exits. From there, the **Agents** page in the sidebar issues
 the install command: click **New install command**, pick Linux, macOS or Windows, and copy the one
-line. (Settings → Organization → Agent updates is a different screen — it schedules how
+line. (An organization's Policies, in the Admin Center, is a different screen — it schedules how
 already-enrolled agents take new builds.)
 
 Four things worth knowing about it:
@@ -431,12 +431,12 @@ Four things worth knowing about it:
 - **It carries an interactive shell.** Beyond what the assistant can do with it, a person gets a real
   terminal on an enrolled machine from the browser — Linux, macOS and Windows alike. Sessions are
   recorded by default, encrypted under `VAULT_MASTER_KEY` and deleted on a retention policy you set
-  under **Settings → Organization → Terminal sessions**. Turning recording off stops the transcript,
+  under **Admin Center → Organizations → *your organization* → Policies**. Turning recording off stops the transcript,
   never the audit entry.
 - **It carries a remote desktop, on Windows.** The same permission model, one level up: a person
   with the right watches the signed-in session's screen from the browser. **Nobody is ever watched
-  invisibly.** Each organization chooses its access policy under **Settings → Organization → Remote
-  desktop** — its existing banner/prompt policy, or an access profile suited to workstations,
+  invisibly.** Each organization chooses its access policy under
+  **Admin Center → Organizations → *your organization* → Policies** — its existing banner/prompt policy, or an access profile suited to workstations,
   infrastructure and shared servers. Every path keeps a visible notice once access is active;
   a pending consent request shows its prompt first. The session ends if the notice cannot be kept
   visible. Nothing of the screen is stored: there is no recording, no thumbnail and no still, so the audit entry is the
@@ -459,7 +459,7 @@ ever opened by the assistant — a person opens them. Decide who holds those bef
 you care about. The desktop has one protection the shell does not, and it is not a permission: the
 person sitting at the machine is told, every time, for as long as it lasts.
 
-**Consent profiles.** An administrator can choose a default under **Settings → Remote desktop**
+**Consent profiles.** An administrator can choose a default under **Admin Center → Organizations → *your organization* → Policies**
 and a machine exception from **Agents → Access profile**. Profiles describe the machine's use,
 independently of its Windows edition: a workstation asks its signed-in user; an infrastructure
 server allows administration with the visible notice; a shared server separates administration
@@ -536,7 +536,7 @@ These are deliberate and documented rather than surprises waiting to be found.
 - **Remote desktop is the newest thing here, and its way out is a switch rather than a rollback.**
   The api and the web roll back by pinning a digest, but an agent has already replaced its own binary
   on every machine it runs on by the time you want it back — so the control that matters is
-  **Settings → Platform → Agents → Remote desktop**. Turning it off refuses new sessions and ends
+  **Admin Center → Settings → Machines → Remote desktop**. Turning it off refuses new sessions and ends
   every live one within 15 seconds, fleet-wide, without touching the interactive shell or anything
   else the agent does. Know where it is before you need it. Two consequences worth holding onto: no
   part of a screen is ever written anywhere, so if an incident needs a record of what was *seen*,
@@ -565,7 +565,7 @@ These are deliberate and documented rather than surprises waiting to be found.
   container healthcheck alone is not a liveness signal for the database.
 - **Outbound mail is Microsoft Graph only.** There is no SMTP and no environment variable for any of
   it: an app registration with `Mail.Send` and a shared mailbox, set up on the **Mail** tab of
-  **Settings → Platform → General**. Without it, invitations still work — the link comes back to the
+  **Admin Center → Settings**. Without it, invitations still work — the link comes back to the
   admin who created it instead of being emailed. Nothing else is emailed: there is no password reset
   and no address verification.
 - The assistant executes real operations on real infrastructure. What stops for a human is the
@@ -619,9 +619,9 @@ wrong on the screen that asks for it.
 | Symptom | Cause |
 | --- | --- |
 | Every page redirects to an install screen | This instance has not been installed yet. That is the wizard, not an error. |
-| The assistant answers "this instance has no model configured" | Exactly that. **Settings → Platform → Model**, where the test button will tell you what the provider thinks. |
+| The assistant answers "this instance has no model configured" | Exactly that. **Admin Center → Settings → Model**, where the test button will tell you what the provider thinks. |
 | api restarts in a loop, logs `Invalid environment configuration` | A value you set yourself is wrong. Only the database, Redis and the vault key are validated at boot now. |
-| The sign-in page loads but cannot sign in | The stored public address is not the one the browser used, scheme included. Change it under **Settings → Platform**. |
+| The sign-in page loads but cannot sign in | The stored public address is not the one the browser used, scheme included. Change it under **Admin Center → Settings → Address**. |
 | Chat never answers and nothing streams | The WebSocket upgrade is not being forwarded. |
 | An answer dies part-way through, every time | The proxy's read timeout is too short. |
 | Everything works but one kind of thing cannot be created | A limit is full — the community edition's, or your licence's. The message names which. See below. |
@@ -638,8 +638,8 @@ There is no password reset in this product — no email flow, no "forgot passwor
 deliberate, and it means the single super-admin the wizard creates is a single point of failure until
 you do something about it.
 
-**Do this now, not later: make a second super-admin.** **Settings → Users → New user**, platform role
-*Super admin*, and set their password on the same screen. Outbound mail is not required for it. Two
+**Do this now, not later: make a second super-admin.** **Admin Center → Users → New user**, platform role
+*Super-admin*, and set their password on the same screen. Outbound mail is not required for it. Two
 minutes, and it turns every case below into somebody else clicking a button.
 
 **If another account can still sign in**, promote it and let it fix the first:
@@ -649,7 +649,7 @@ docker compose exec -T postgres psql -U jarvis -d jarvis \
   -c "UPDATE \"User\" SET \"platformRole\" = 'SUPER_ADMIN' WHERE email = 'colleague@example.com';"
 ```
 
-They then reset the locked-out password under **Settings → Users**.
+They then reset the locked-out password under **Admin Center → Users**.
 
 **If no account can sign in at all**, set a password hash directly. Jarvis stores argon2id, and the
 api image carries the library that makes one — so the hash is generated by the same code that will
@@ -672,7 +672,7 @@ docker compose exec -T postgres psql -U jarvis -d jarvis -c \
 Quote the hash in single quotes — it contains `$` characters your shell would otherwise eat.
 
 If the account also holds a second factor you no longer have: when another administrator exists, they
-do it properly from **Settings → Users**, which strips the factors, ends every open session and files
+do it properly from **Admin Center → Users**, which strips the factors, ends every open session and files
 an audit entry. With nobody left to click it, clear all three parts by hand — the passkeys, the
 authenticator secret, and the flag that says a factor is expected — or the account will keep
 demanding one:
@@ -694,7 +694,7 @@ clearing those columns by hand would hand your live instance to whoever reaches
 
 ### Moving the instance to a new address
 
-Changing the public address under **Settings → Platform → Instance** is supported, and it has two
+Changing the public address under **Admin Center → Settings → Address** is supported, and it has two
 consequences that are not obvious and not reversible by changing it back.
 
 **Enrolled agents keep dialling the old one.** Each machine stores the address it was enrolled with
@@ -785,7 +785,7 @@ docker run --rm -v jarvis_secrets:/s alpine rm -f /s/vault-master-key
 # then the `.env` line above, then `docker compose up -d`
 ```
 
-To check you restored under the right one, reveal a stored credential in **Settings → Vault**. The
+To check you restored under the right one, reveal a stored credential in the **Vault**. The
 rows are all there under a wrong key; only a reveal tells you the truth.
 
 ## Removing it
@@ -840,21 +840,21 @@ reach us would just be an email with extra steps.
 community or licensed, the same fields either way — because it is the only way we see which builds
 are in the field when one of them turns out to need a warning, and because the licence request form
 below travels the same channel. What leaves is listed field by field in the next section, and
-**Settings → Licence** shows you the exact address and the exact contents from the running instance
+**Admin Center → Licence** shows you the exact address and the exact contents from the running instance
 rather than from this document.
 
 Everything in the next section applies to a community instance as well: the field list is the whole
 field list, and it is the same one.
 
 To go further — more organizations for a real client base, more seats, more machines — ask for a
-licence from **Settings → Licence** inside your own instance. That form is signed by your
+licence from **Admin Center → Licence** inside your own instance. That form is signed by your
 installation, so an approved licence lands on it by itself, with nothing to paste.
 
 ## Licence keys, and what your instance reports
 
 **A licence key raises the limits.** Ask for one (see
 [below](#getting-a-licence-and-getting-help)) and put it in `.env` as `JARVIS_LICENSE_KEY`, or paste
-it under **Settings → Licence**. The key is a signed token your instance verifies **offline** — it
+it under **Admin Center → Licence**. The key is a signed token your instance verifies **offline** — it
 carries your term and your limits, and it needs no network to be checked.
 
 **A licence that stops applying drops back to the community edition**, and never to nothing. Expired,
@@ -908,7 +908,7 @@ the identities or roles behind it.
 **The public URL is the one field that names your network rather than measuring something, and it is
 sent.** It used to be a switch on the licence screen; it is not any more, because an installation the
 publisher can identify only by a fingerprint is one where "which of these is the customer calling
-about" has no answer. The screen shows you the exact address that leaves, under **Settings →
+about" has no answer. The screen shows you the exact address that leaves, under **Admin Center →
 Licence**.
 
 **There is no way to switch this off**, on a community instance or a licensed one. It is the same
@@ -934,7 +934,7 @@ checked without a network.
 
 **Off unless a platform administrator turns it on, and only on a paid or trial licence.** Your
 Jarvis provider can run a model for licensed instances, so that the assistant works without an
-endpoint or a key of your own. A platform administrator chooses it under **Settings → Platform →
+endpoint or a key of your own. A platform administrator chooses it under **Admin Center → Settings →
 Model**, or on the model step of the install screen, which shows the same choice once the licence
 step before it has linked the instance to its licence. Either way it is chosen on a screen that
 states everything below and asks them to confirm they have read it. Nothing else selects it: no
@@ -959,7 +959,7 @@ Each request also carries a short-lived credential. Your instance obtains it wit
 exactly as its licence report is, which carries the product (`jarvis`), the licence id, the instance
 id and public key, and the version — nothing else — and it keeps the credential in memory only.
 
-**Opening the screen already asks.** On a licensed instance, opening **Settings → Platform → Model**
+**Opening the screen already asks.** On a licensed instance, opening **Admin Center → Settings → Model**
 — or reaching the model step of the install screen — sends that signed request, so the screen can
 say whether the managed model is offered to you and which model it is, whether or not anybody then
 chooses it. It carries the fields above and no conversation content, and your Jarvis provider sees
@@ -1009,7 +1009,7 @@ mandatory egress proxy can use neither this, nor its own provider, nor the licen
 
 ## Asking for a licence
 
-**From inside your own instance: Settings → Licence → Ask for a licence.** Fill in who you are — a
+**From inside your own instance: Admin Center → Licence → Ask for a licence.** Fill in who you are — a
 company name and somebody to answer are the only required fields — roughly what you need, and send.
 
 What makes this worth doing from in there rather than by email: the form is **signed by your