diff --git a/backend/src/Hookline.Host/Endpoints/AuthEndpoints.cs b/backend/src/Hookline.Host/Endpoints/AuthEndpoints.cs
index 59012ee..15d3f28 100644
--- a/backend/src/Hookline.Host/Endpoints/AuthEndpoints.cs
+++ b/backend/src/Hookline.Host/Endpoints/AuthEndpoints.cs
@@ -17,8 +17,7 @@ public static void MapHooklineAuthEndpoints(this IEndpointRouteBuilder app)
         group.MapGet("/bootstrap-state", async (UserService users) =>
         {
             var ownerExists = await users.OwnerExistsAsync();
-            var all = await users.ListAsync();
-            return Results.Ok(new { ownerExists, userCount = all.Count });
+            return Results.Ok(new { ownerExists });
         });
 
         // The BFF validates here, then mints the session cookie + identity assertion.
diff --git a/backend/src/Hookline.Infrastructure/Auth/UserService.cs b/backend/src/Hookline.Infrastructure/Auth/UserService.cs
index e2a6ab6..4bd33c4 100644
--- a/backend/src/Hookline.Infrastructure/Auth/UserService.cs
+++ b/backend/src/Hookline.Infrastructure/Auth/UserService.cs
@@ -41,7 +41,8 @@ public async Task BootstrapAsync(CancellationToken ct = default)
         if (string.IsNullOrWhiteSpace(password))
         {
             password = GenerateBreakGlassPassword();
-            logger.LogWarning("BOOTSTRAP_ADMIN_PASSWORD (generated, capture now): {Password}", password);
+            Console.Error.WriteLine($"BOOTSTRAP_ADMIN_PASSWORD (generated, capture now): {password}");
+            logger.LogWarning("Generated bootstrap admin password — capture from stderr. It will not be shown again.");
         }
 
         db.Users.Add(new User
diff --git a/web/src/features/auth/hooks.ts b/web/src/features/auth/hooks.ts
index 3bee819..7e54270 100644
--- a/web/src/features/auth/hooks.ts
+++ b/web/src/features/auth/hooks.ts
@@ -13,7 +13,6 @@ export interface Me {
 
 export interface BootstrapState {
   ownerExists: boolean;
-  userCount: number;
 }
 
 /** Current user, or null when unauthenticated (401 is not an error here). */