diff --git a/gitnexus/src/cli/ci-setup/templates.ts b/gitnexus/src/cli/ci-setup/templates.ts
index b97e514b4..bc193f2ab 100644
--- a/gitnexus/src/cli/ci-setup/templates.ts
+++ b/gitnexus/src/cli/ci-setup/templates.ts
@@ -273,7 +273,7 @@ function buildAcaDeployScript(opts: CiSetupOptions): string {
 # Deploy GitNexus as an Azure Container App.
 # Requires: az CLI, logged in with Contributor on the target resource group.
 #
-# ${authComment}
+${authComment}
 
 set -euo pipefail
 
diff --git a/gitnexus/test/unit/ci-setup-templates.test.ts b/gitnexus/test/unit/ci-setup-templates.test.ts
index a01698128..9828d165f 100644
--- a/gitnexus/test/unit/ci-setup-templates.test.ts
+++ b/gitnexus/test/unit/ci-setup-templates.test.ts
@@ -160,6 +160,12 @@ describe('ACA deploy script + connection guidance (U6)', () => {
     expect(md).toContain('ingress internal');
     expect(md).not.toContain(':4748/api/mcp');
   });
+
+  it('ACA auth comment is not double-hashed (U10)', () => {
+    expect(aca({ auth: 'token' })).not.toContain('# # ');
+    expect(aca({ auth: 'none' })).not.toContain('# # ');
+    expect(aca({ auth: 'token' })).toContain('# Auth: this deploys with --ingress internal');
+  });
 });
 
 describe('version pinning (U9)', () => {