diff --git a/docs/developer/api/admin/list_users.md b/docs/developer/api/admin/list_users.md
index c15d4976..a50251a0 100644
--- a/docs/developer/api/admin/list_users.md
+++ b/docs/developer/api/admin/list_users.md
@@ -42,27 +42,22 @@ Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
     "id": "550e8400-e29b-41d4-a716-446655440000",
     "email": "user@example.com",
     "username": "johndoe",
-    "password_hash": "$2a$04$REDACTED",
+    "theme": "tokyo-night",
     "first_name": "John",
     "last_name": "Doe",
     "role": "user",
-    "theme": "tokyo-night",
     "max_devices": 10,
     "created_at": "2026-02-08T10:00:00Z",
-    "timezone": "America/New_York",
     "updated_at": "2026-02-08T10:00:00Z",
-    "default_audio_speed": 1
+    "device_count": 3
   }
 ]
 ```
 
-Response is a bare JSON array of full user rows — no pagination wrapper
-and no `device_count` (those were invented in an earlier draft).
-
-**Leak note:** the user model json-marshals `password_hash` verbatim —
-the list-users response exposes password hashes to any admin caller.
-Known defect, tracked separately (doc mirrors the real field set; do not
-implement against a redacted shape).
+Response is a bare JSON array of sqlc `ListUsersRow`s (user fields plus a
+`device_count` join) — no pagination wrapper. Live-smoke-verified
+2026-10-24: **`password_hash` is NOT in the response** (an earlier draft
+of this doc wrongly claimed a hash leak).
 
 ### Response Fields
 
@@ -79,9 +74,6 @@ implement against a redacted shape).
 | `device_count` | integer | Current number of registered devices  |
 | `created_at`   | string  | Account creation timestamp (ISO 8601) |
 | `updated_at`   | string  | Last update timestamp (ISO 8601)      |
-| `total`        | integer | Total number of users matching query  |
-| `limit`        | integer | Limit applied to this request         |
-| `offset`       | integer | Offset applied to this request        |
 
 ## Error Responses
 
diff --git a/internal/docs/schema.go b/internal/docs/schema.go
index 8dddf544..be02e4f7 100644
--- a/internal/docs/schema.go
+++ b/internal/docs/schema.go
@@ -687,7 +687,9 @@ var Schemas = map[string]Schema{
 		}`),
 	},
 	"GET /api/auth/users": {
-		Response: []database.Users{},
+		// sqlc join row (device_count), NOT database.Users — no password_hash
+		// on the wire (live-smoke-verified 2026-10-24).
+		Response: []database.ListUsersRow{},
 	},
 	"PUT /api/auth/users/:id/max-devices": {
 		Request:  handlers.UpdateUserMaxDevicesRequest{},