diff --git a/tradein-mvp/backend/app/api/v1/me.py b/tradein-mvp/backend/app/api/v1/me.py
index ef1dac95..367b913e 100644
--- a/tradein-mvp/backend/app/api/v1/me.py
+++ b/tradein-mvp/backend/app/api/v1/me.py
@@ -78,7 +78,7 @@ async def me(
     if not x_authenticated_user:
         raise HTTPException(
             status_code=401,
-            detail="no authenticated user (Caddy basic_auth required)",
+            detail="no authenticated user (valid session required)",
         )
     try:
         return get_user_scope(x_authenticated_user)
diff --git a/tradein-mvp/backend/app/api/v1/trade_in.py b/tradein-mvp/backend/app/api/v1/trade_in.py
index 853d9a1d..3bfa7e73 100644
--- a/tradein-mvp/backend/app/api/v1/trade_in.py
+++ b/tradein-mvp/backend/app/api/v1/trade_in.py
@@ -63,7 +63,7 @@ def _assert_estimate_access(created_by: str | None, x_authenticated_user: str |
     if not x_authenticated_user:
         raise HTTPException(
             status_code=401,
-            detail="no authenticated user (Caddy basic_auth required)",
+            detail="no authenticated user (valid session required)",
         )
 
     from app.core.auth import get_role
@@ -688,7 +688,7 @@ def estimate_history(
     if not x_authenticated_user:
         raise HTTPException(
             status_code=401,
-            detail="no authenticated user (Caddy basic_auth required)",
+            detail="no authenticated user (valid session required)",
         )
 
     from app.core.auth import get_role
diff --git a/tradein-mvp/backend/app/core/rbac.py b/tradein-mvp/backend/app/core/rbac.py
index c391c366..e8c5fc04 100644
--- a/tradein-mvp/backend/app/core/rbac.py
+++ b/tradein-mvp/backend/app/core/rbac.py
@@ -222,7 +222,7 @@ async def rbac_guard(
         if not username:
             return JSONResponse(
                 status_code=401,
-                content={"detail": "no authenticated user (Caddy basic_auth required)"},
+                content={"detail": "no authenticated user (valid session required)"},
             )
 
         # #2213 defense-in-depth: если общий секрет задан — запрос с X-Authenticated-User