diff --git a/.dockerignore b/.dockerignore
index 0256fe1..a6d701c 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -7,5 +7,4 @@ content/*.mp4
 content/*.pdf
 *.md
 !README.md
-docker/auth
 content/crowd
diff --git a/.gitignore b/.gitignore
index 6f17b5d..c30672a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -53,5 +53,3 @@ content/*.mov
 # previz source renders (web versions in public/previz)
 content/crowd/
 
-# server-side login files for /previz/ (see DEPLOY.md)
-docker/auth/
diff --git a/DEPLOY.md b/DEPLOY.md
index 7702fe0..b21607b 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -112,22 +112,6 @@ The workflow is already in the repo (`.gitea/workflows/deploy.yml`). In Gitea, o
 Test it: push any commit to `main` and watch **Actions** in the repo. The job should run
 `git pull` and `docker compose up -d --build`, then the site updates.
 
-### 8. Password for /previz/
-
-Client previz pages under `/previz/` need a login (HTTP basic auth in `docker/nginx.conf`).
-The password file stays on the server and is never committed. Create it once:
-
-```bash
-cd /opt/ttvfx_web
-mkdir -p docker/auth
-printf "production:$(openssl passwd -apr1)\n" > docker/auth/previz.htpasswd   # prompts for the password
-docker compose up -d --force-recreate
-```
-
-`production` is the username. To change the password, run the `printf` line again. nginx reads
-the file on every request, so no restart is needed. To add a second login, append another line
-with `>>`. If the file is missing, `/previz/` returns a 500 error, so it is never left open.
-
 ---
 
 ## Day to day
diff --git a/docker-compose.yml b/docker-compose.yml
index 956fc24..b14e638 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,10 +5,6 @@ services:
 
     restart: unless-stopped
 
-    # Login for /previz/ (gitignored; created once on the server, see DEPLOY.md)
-    volumes:
-      - ./docker/auth:/etc/nginx/auth:ro
-
     networks:
       - npm_default
 
diff --git a/docker/nginx.conf b/docker/nginx.conf
index da034b8..b1df78a 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -23,12 +23,9 @@ server {
         add_header Cache-Control "public, max-age=604800";
     }
 
-    # Client previz pages: password protected (file lives on the server, see DEPLOY.md).
-    # ^~ beats the media regex above, so nothing in here gets a public cache header
-    # and Cloudflare never serves it to someone who hasn't logged in.
+    # Client previz pages: never cached, so updated renders show up straight away.
+    # ^~ beats the media regex above, so nothing in here gets the week-long cache.
     location ^~ /previz/ {
-        auth_basic "Two Tales VFX previz";
-        auth_basic_user_file /etc/nginx/auth/previz.htpasswd;
         add_header Cache-Control "private, no-store";
         try_files $uri $uri/ $uri.html =404;
     }