diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
index 5eb13a2..8555356 100644
--- a/ansible/ansible.cfg
+++ b/ansible/ansible.cfg
@@ -10,6 +10,15 @@ callback_result_format = yaml
 display_skipped_hosts = False
 interpreter_python = auto_silent
 
+# The account every playbook connects as. Deliberately here and not as
+# ansible_user in group_vars/all.yml: an inventory variable outranks a
+# command-line -u, so a `-u somebody` would be accepted and then silently
+# ignored. A config default sits *below* -u, which is what lets bootstrap.yml —
+# the one playbook that has to connect as somebody else — take a plain
+# `-u <admin-user>`. Override it for a single host with ansible_user in
+# inventory/host_vars/<host>.yml.
+remote_user = deploy
+
 # CI runners are ephemeral, so a known_hosts file never survives to be checked
 # against. Turn this back on if you deploy from a durable control node or put a
 # bastion in front of the hosts — it is the one setting here worth revisiting.
diff --git a/ansible/inventory/group_vars/all.yml b/ansible/inventory/group_vars/all.yml
index 4533fdb..30c04a9 100644
--- a/ansible/inventory/group_vars/all.yml
+++ b/ansible/inventory/group_vars/all.yml
@@ -1,5 +1,9 @@
 ---
-ansible_user: deploy
+# ansible_user is deliberately absent. The deploy account is `remote_user` in
+# ansible.cfg instead, because an inventory variable cannot be overridden by a
+# command-line -u and a config default can. Set ansible_user in
+# inventory/host_vars/<host>.yml to change it for one host.
+
 # Override per host in inventory/host_vars/<host>.yml if sshd moves off 22.
 ansible_port: 22