diff --git a/web/components/public-account-entry.tsx b/web/components/public-account-entry.tsx
index 740a2ac3cb..b6f05441c5 100644
--- a/web/components/public-account-entry.tsx
+++ b/web/components/public-account-entry.tsx
@@ -22,7 +22,7 @@ export function PublicAccountEntry({
     <div className="portal-home">
       <section className="portal-section">
         <div className="portal-container public-account-entry">
-          {/* Exact founder raster; do not restyle or substitute a traced SVG. */}
+          {/* Pinned app-icon raster generated from brand/mark.svg; do not restyle. */}
           {/* eslint-disable-next-line @next/next/no-img-element */}
           <img
             className="public-account-mark"
diff --git a/web/lib/public-auth-routes.test.ts b/web/lib/public-auth-routes.test.ts
index 95350b46a6..6fdd04e446 100644
--- a/web/lib/public-auth-routes.test.ts
+++ b/web/lib/public-auth-routes.test.ts
@@ -63,7 +63,7 @@ describe("CWC destinations", () => {
 });
 
 describe("canonical mark", () => {
-  it("ships the exact founder raster, not a redrawn substitute", () => {
+  it("ships the pinned raster generated from the canonical vector", () => {
     const bytes = readFileSync(new URL("../public/brand/codewhale-mark.png", import.meta.url));
     expect(createHash("sha256").update(bytes).digest("hex")).toBe(CANONICAL_MARK_SHA256);
     expect(CANONICAL_MARK_SRC).toBe("/brand/codewhale-mark.png");
diff --git a/web/lib/public-auth-routes.ts b/web/lib/public-auth-routes.ts
index d9a738dbc0..665df61d8b 100644
--- a/web/lib/public-auth-routes.ts
+++ b/web/lib/public-auth-routes.ts
@@ -11,10 +11,15 @@
 import { APP_URL } from "./i18n/links";
 import { pathLocale } from "./i18n/path";
 
-/** Exact founder raster (1254×1254) used on public account-entry pages. */
+/**
+ * App-icon raster (1254×1254) used on public account-entry pages: the canonical
+ * mark in white on a navy field, generated from `public/brand/mark.svg`. The
+ * vector is the master — never hand-edit this PNG, regenerate it. Pinned by
+ * hash so a redrawn or stale substitute fails the test rather than shipping.
+ */
 export const CANONICAL_MARK_SRC = "/brand/codewhale-mark.png";
 export const CANONICAL_MARK_SHA256 =
-  "5a2a34283560a3f0d65ab966ae49b88f67f5f26d659791213fa1120c1bc8929d";
+  "8b4c25460cb2a913bc42e4b97a06a09e4fd3bb31a93dc2da169a2858bbb34f01";
 
 export const APP_AUTH_CALLBACK_URL = `${APP_URL}/auth/callback`;
 
diff --git a/web/public/brand/codewhale-mark.png b/web/public/brand/codewhale-mark.png
index 0d4489b2a1..a65081cfc7 100644
Binary files a/web/public/brand/codewhale-mark.png and b/web/public/brand/codewhale-mark.png differ