diff --git a/src/servers/api/desktop/rest.ts b/src/servers/api/desktop/rest.ts
index 3cac087a..671b06a3 100644
--- a/src/servers/api/desktop/rest.ts
+++ b/src/servers/api/desktop/rest.ts
@@ -1,19 +1,19 @@
 import { createRouter } from '../../create-router';
-import { getVncPassword } from './vnc-config';
 import * as sidecar from '@@/sidecar-registry';
 
 export const desktopRouter = createRouter();
 
 // The desktop UI asks for the password before it can open the WebSocket — and that WebSocket is what
 // starts the VNC session. So this cannot wait for a session to exist: on a fresh install nothing has
-// ever written the password, and answering "not configured" deadlocked the page permanently. Ask the
-// sidecar to provision it instead; it owns the .vnc directory and the call is idempotent.
+// ever written the password, and answering "not configured" deadlocked the page permanently.
+//
+// Officer does not read the password file itself. It lives in the owner's ~/.vnc, next to the rfbauth
+// file x11vnc authenticates against, and the sidecar is the process that writes both — so it is the
+// process that answers for them too. `vnc:ensure-password` is idempotent: it returns the existing
+// pair when both files are already there, and provisions them when they are not.
 desktopRouter.get('/vnc-password', async (ctx) => {
   const user = ctx.get('user');
 
-  const existing = await getVncPassword(user.email);
-  if (existing) return ctx.json({ password: existing });
-
   if (!sidecar.isVncConnected()) {
     return ctx.json({ error: 'VNC sidecar is not connected' }, 503);
   }
diff --git a/src/servers/api/desktop/vnc-config.ts b/src/servers/api/desktop/vnc-config.ts
deleted file mode 100644
index f808255f..00000000
--- a/src/servers/api/desktop/vnc-config.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import { join } from 'node:path';
-import { getOwnerHomeDir } from '@@/data-path';
-
-const getVncDir = (email: string): string => join(getOwnerHomeDir(email), '.vnc');
-
-export async function getVncPassword(email: string): Promise<string | null> {
-  const file = Bun.file(join(getVncDir(email), 'password'));
-  if (!(await file.exists())) return null;
-  return (await file.text()).trim();
-}