diff --git a/e2e/README.md b/e2e/README.md
index 5e844a5..3290c2c 100644
--- a/e2e/README.md
+++ b/e2e/README.md
@@ -25,6 +25,19 @@ These hit the live production dashboard and a live Authentik instance, and need
 credentials as secrets — deliberately not run automatically on every push. Run by hand
 after auth-related changes.
 
+## Coverage
+
+- `local-login.spec.ts` — happy path (login/logout), wrong password rejected, session
+  survives a page reload.
+- `oidc-login.spec.ts` — happy path through a real Authentik login, wrong password
+  rejected (stays on Authentik, never reaches the dashboard).
+- `api-auth.spec.ts` — `/api/hosts`, `/api/devices`, `/api/auth/me` all reject
+  unauthenticated requests; a failed login grants no access even though a session
+  cookie gets issued (that's normal `@fastify/session` behavior, not a leak — what
+  matters is whether the cookie carries authentication, which it doesn't).
+
+9 tests, confirmed stable across repeated full-suite runs with parallel workers.
+
 ## Bugs these caught on first write (all fixed, kept as regression coverage)
 
 1. **Local logout silently failed.** Frontend always sent `Content-Type: