diff --git a/docs/DASHBOARD_SETUP.md b/docs/DASHBOARD_SETUP.md
index 1a26bd6..009c8b4 100644
--- a/docs/DASHBOARD_SETUP.md
+++ b/docs/DASHBOARD_SETUP.md
@@ -49,14 +49,16 @@ kubectl get svc -n kubernetes-dashboard
 
 ### Login to Dashboard
 
-The dashboard is configured with `--enable-skip-login`, so you can skip the login screen. However, if you need to authenticate:
+The dashboard is configured with `--enable-skip-login`, so it opens straight to the UI - no token needed to look around.
 
-1. Get the token:
+Skip-login runs as the dashboard's own `kubernetes-dashboard` ServiceAccount, which is **view-only** (get/list/watch). If you need to edit, delete, or exec into something:
+
+1. Get an admin token:
 ```bash
 kubectl -n kubernetes-dashboard create token admin-user
 ```
 
-2. Copy the token and paste it in the dashboard login screen.
+2. Click "Sign In" on the dashboard and paste the token.
 
 ### What You Can See
 
diff --git a/manifests/alaska/k8s-dashboard.yaml b/manifests/alaska/k8s-dashboard.yaml
index 7b6bca0..c8d7203 100644
--- a/manifests/alaska/k8s-dashboard.yaml
+++ b/manifests/alaska/k8s-dashboard.yaml
@@ -62,6 +62,13 @@ spec:
         args:
           - --auto-generate-certificates
           - --namespace=kubernetes-dashboard
+          - --enable-skip-login
+          # Skip-login uses the "kubernetes-dashboard" ServiceAccount below,
+          # which only has get/list/watch (view-only) - so opening the
+          # dashboard needs no token, but it can't edit/delete/exec.
+          # For write access, still log in with the admin-user token
+          # (kubectl -n kubernetes-dashboard create token admin-user).
+          #
           # --token-ttl=0 was tried here to disable the 15-min idle
           # timeout, but login broke immediately after that pod came up -
           # in this dashboard version, 0 appears to mean "expire