diff --git a/app/src/web/admin/config.yml b/app/src/web/admin/config.yml
index 2c9d81b..0b854ef 100644
--- a/app/src/web/admin/config.yml
+++ b/app/src/web/admin/config.yml
@@ -12,13 +12,12 @@ backend:
   auth_endpoint: login/oauth/authorize
   clear_credentials_before_refresh: false
 
-# Media goes to Garage S3 via shortcode at render time; Decap just stores the
-# object key inside the .md. If you instead want files committed to the repo,
-# point media_folder at content/media and public_folder at /media.
+# Media: images are git files beside their article (content/subjects/<s>/<slug>/).
+# Reference via {{media:<slug>/<file>}}. The Decap media library is DISABLED so it
+# cannot create orphan files in the repo — add images by dropping them into the
+# Obsidian content folder instead.
 media_folder: ""
 public_folder: ""
-# Media library is DISABLED — images are uploaded via the Kontra app at /admin/media
-# (stored in Garage S3) and referenced in front matter as {{media:filename}}.
 
 # ------------------------------------------------------------------
 # Collections
diff --git a/app/src/web/assets/kontra.css b/app/src/web/assets/kontra.css
index f93013b..2df8cf6 100644
--- a/app/src/web/assets/kontra.css
+++ b/app/src/web/assets/kontra.css
@@ -113,6 +113,10 @@ figure.plate img { display: block; width: 100%; filter: grayscale(1) contrast(1.
 figure.gridplate { background: var(--surface); border: 1px solid var(--hairline); }
 figure.gridplate img { display: block; width: 100%; aspect-ratio: 3/2; filter: grayscale(1) contrast(1.05); }
 
+/* Body/raw markdown images: never exceed their container (fixes overflow past column). */
+.article-body img, .content-column img, .article-body video { max-width: 100%; height: auto; }
+.container img { max-width: 100%; height: auto; }
+
 .pullquote { background: var(--surface); border-left: 4px solid var(--accent); padding: 24px; border-radius: 0; }
 .pullquote .mark { font-family: var(--font-display); color: var(--accent); font-size: 38px; line-height: 1; opacity: 0.8; }