diff --git a/CLAUDE.md b/CLAUDE.md
index 215520d7..2f87072c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -116,8 +116,11 @@ an identity rule binding transport config.
   web console — see [`docs/SECURITY.md`](docs/SECURITY.md)): local + AD (LDAP/Kerberos) users, fixed
   built-in roles, deny-by-default per-route permissions, opaque sessions, native TOTP MFA + browser
   WebAuthn passkeys (WP-14/WP-14b, ADR 0068 — `[webauthn]` extra) for local
-  accounts (AD MFA delegated), full audit. The API still
-  binds `127.0.0.1` by default; remote **TLS** exposure is later.
+  accounts (AD MFA delegated), full audit. The API binds `127.0.0.1` by default and **always
+  serves TLS** ([ADR 0172](docs/adr/0172-the-engine-always-serves-tls-minting-a-self-signed-certificate-on-first-run.md)):
+  an operator-supplied `[api].tls_cert_file` wins if set, otherwise the engine mints and reuses a
+  self-signed pair on first run. Remote network exposure (opening the bind beyond loopback) is
+  still a separate, later question from whether the hop itself is encrypted.
 
 **Staged pipeline (ADR 0001, Step B).** The store is a **generic staged queue** on SQLite (WAL)
 with a `stage` discriminator. A received message flows through three persisted stages: **`ingress`**
diff --git a/messagefoundry/api/app.py b/messagefoundry/api/app.py
index 93e7cb45..bff2669c 100644
--- a/messagefoundry/api/app.py
+++ b/messagefoundry/api/app.py
@@ -15,8 +15,10 @@
 Authentication + RBAC are enforced whenever an enabled :class:`AuthService` is attached (the
 ``serve`` path always attaches one). With **no** auth attached the routes are **fail-closed** (403)
 unless the app explicitly opts out via ``allow_no_auth=True`` (embedding / dev), in which case
-requests run as the full-access system identity (SYS-1). The API still binds localhost by default;
-remote exposure (TLS) is later.
+requests run as the full-access system identity (SYS-1). The API binds localhost by default and
+always serves TLS (ADR 0172): an operator-supplied certificate wins if configured, otherwise the
+engine mints and reuses a self-signed pair on first run. Remote network exposure (opening the
+bind beyond loopback) is a separate, later question from whether the hop is encrypted.
 """
 
 from __future__ import annotations