diff --git a/charts/openab/templates/NOTES.txt b/charts/openab/templates/NOTES.txt
index 1b836910..2030ed6f 100644
--- a/charts/openab/templates/NOTES.txt
+++ b/charts/openab/templates/NOTES.txt
@@ -32,7 +32,7 @@ Agents deployed:
     kubectl exec -it deployment/{{ include "openab.agentFullname" (dict "ctx" $ "agent" $name) }} -- codex login --device-auth
 {{- else if eq (toString $cfg.command) "claude-agent-acp" }}
     Authenticate:
-    kubectl exec -it deployment/{{ include "openab.agentFullname" (dict "ctx" $ "agent" $name) }} -- claude setup-token
+    kubectl exec -it deployment/{{ include "openab.agentFullname" (dict "ctx" $ "agent" $name) }} -- claude auth login
 {{- else if eq (toString $cfg.command) "gemini" }}
     Authenticate:
     kubectl exec -it deployment/{{ include "openab.agentFullname" (dict "ctx" $ "agent" $name) }} -- gemini
diff --git a/docs/claude-code.md b/docs/claude-code.md
index a8f4479f..00c9129a 100644
--- a/docs/claude-code.md
+++ b/docs/claude-code.md
@@ -35,6 +35,16 @@ working_dir = "/home/node"
 
 ## Authentication
 
+Sign in interactively using the OAuth device flow. Credentials are stored on disk (persisted via PVC across pod restarts):
+
+```bash
+kubectl exec -it deployment/openab-claude -- claude auth login
+```
+
+After authenticating, restart the pod so the bot process loads the new credentials:
+
 ```bash
-kubectl exec -it deployment/openab-claude -- claude setup-token
+kubectl rollout restart deployment/openab-claude
 ```
+
+> **Note:** `claude setup-token` is a different command — it generates a long-lived token for CI/scripts and prints it without saving locally. For container-based deployments, `claude auth login` is the correct approach as it persists credentials to the filesystem.
diff --git a/src/setup/wizard.rs b/src/setup/wizard.rs
index 8a346400..e8751172 100644
--- a/src/setup/wizard.rs
+++ b/src/setup/wizard.rs
@@ -525,7 +525,7 @@ fn print_next_steps(agent: &str, output_path: &Path, is_local: bool) {
                 cprintln!(C.cyan, "  1. Install Claude Code + ACP adapter:");
                 println!("       npm install -g @anthropic-ai/claude-code @agentclientprotocol/claude-agent-acp");
                 cprintln!(C.cyan, "  2. Authenticate:");
-                println!("       claude setup-token");
+                println!("       claude auth login");
             }
             "codex" => {
                 cprintln!(C.cyan, "  1. Install Codex CLI + ACP adapter:");
@@ -560,7 +560,7 @@ fn print_next_steps(agent: &str, output_path: &Path, is_local: bool) {
                 "       kubectl exec -it deployment/openab-kiro -- kiro-cli login --use-device-flow"
             ),
             "claude" => println!(
-                "       kubectl exec -it deployment/openab-claude -- claude setup-token"
+                "       kubectl exec -it deployment/openab-claude -- claude auth login"
             ),
             "codex" => println!(
                 "       kubectl exec -it deployment/openab-codex -- codex login --device-auth"