diff --git a/.env.example b/.env.example
index 0679589..134c9c5 100644
--- a/.env.example
+++ b/.env.example
@@ -102,8 +102,15 @@ STREAM_BROWSER=true
 #   oauth  = use the Gemini CLI with a Google-account login (no API key).
 #            Install once: npm i -g @google/gemini-cli ; then run `gemini` and
 #            "Sign in with Google". Uses the CLI's built-in web-search grounding.
-#   apikey = legacy REST path; needs GEMINI_API_KEY below
-#            (get one at https://aistudio.google.com/app/apikey).
+#            NOTE (2026-06): Google is blocking personal Google accounts on this
+#            path ("This client is no longer supported for Gemini Code Assist for
+#            individuals"). Workspace/org accounts may still work; personal
+#            accounts should use apikey below instead.
+#   apikey = REST path; needs GEMINI_API_KEY below
+#            (get one at https://aistudio.google.com/app/apikey). Recommended for
+#            personal Google accounts now that individual OAuth login is blocked.
+# Either way, real-time search fail-opens to DDG/Brave/Wikipedia if Gemini is
+# unavailable, so this is optional, not required.
 GEMINI_AUTH=oauth
 GEMINI_API_KEY=
 GEMINI_MODEL=gemini-2.0-flash
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index c21a13f..f425590 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -68,6 +68,11 @@ human-style input (visible on its VNC).
   compose runs from PowerShell/cmd). Seed it once from a machine with a browser and
   the logged-in Gemini CLI (`npm i -g @google/gemini-cli`, then `gemini` ->
   "Sign in with Google"), copying the login state:
+  (Note: as of 2026-06 Google blocks personal Google accounts on this CLI login
+  with "This client is no longer supported for Gemini Code Assist for
+  individuals". Workspace/org accounts may still work; personal accounts should
+  use `GEMINI_AUTH=apikey` with a key from https://aistudio.google.com/app/apikey
+  instead. Real-time search fail-opens to DDG/Brave/Wikipedia either way.)
   `cp -r ~/.gemini/. docker/gemini-oauth/`. The essential file is `oauth_creds.json`
   (it holds the refresh token; `GOOGLE_GENAI_USE_GCA=true` forces OAuth, so that is
   the file the startup readiness check looks for) - copying the whole dir simply also