diff --git a/config/auth.php b/config/auth.php
index 3975db6..3807c3c 100644
--- a/config/auth.php
+++ b/config/auth.php
@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-use App\Models\User;
+use Infra\Database\Models\ApiClient;
 
 return [
 
@@ -66,7 +66,7 @@ return [
     'providers' => [
         'users' => [
             'driver' => 'eloquent',
-            'model'  => env('AUTH_MODEL', User::class),
+            'model'  => env('AUTH_MODEL', ApiClient::class),
         ],
 
         // 'users' => [
diff --git a/database/factories/UserFactory.php b/database/factories/UserFactory.php
deleted file mode 100644
index d2c4b35..0000000
--- a/database/factories/UserFactory.php
+++ /dev/null
@@ -1,46 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Database\Factories;
-
-use Illuminate\Database\Eloquent\Factories\Factory;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Str;
-
-/**
- * @extends Factory<User>
- */
-class UserFactory extends Factory
-{
-    /**
-     * The current password being used by the factory.
-     */
-    protected static ?string $password;
-
-    /**
-     * Define the model's default state.
-     *
-     * @return array<string, mixed>
-     */
-    public function definition(): array
-    {
-        return [
-            'name'              => fake()->name(),
-            'email'             => fake()->unique()->safeEmail(),
-            'email_verified_at' => now(),
-            'password'          => static::$password ??= Hash::make('password'),
-            'remember_token'    => Str::random(10),
-        ];
-    }
-
-    /**
-     * Indicate that the model's email address should be unverified.
-     */
-    public function unverified(): static
-    {
-        return $this->state(fn (array $attributes) => [
-            'email_verified_at' => null,
-        ]);
-    }
-}
diff --git a/storage/auditor-findings.json b/storage/auditor-findings.json
index 36ba3cc..fc8a39d 100644
--- a/storage/auditor-findings.json
+++ b/storage/auditor-findings.json
@@ -208,7 +208,7 @@
             "domain": "conventions",
             "severity": "low",
             "confidence": "confirmed",
-            "status": "open",
+            "status": "fixed",
             "summary": "config/auth.php imports and references App\\Models\\User practical class which does not exist in this DDD/Clean Architecture application.",
             "why_it_matters": "The project authenticates via custom HMAC and api_clients table. Referencing non-existent classes and creating unused Laravel boilerplate tables (users, password_reset_tokens, personal_access_tokens) creates confusion and runtime errors if default guards are triggered.",
             "evidence": [
@@ -233,8 +233,8 @@
             ],
             "symbol": "config/auth.php",
             "recommendation": "Update config/auth.php to point to ApiClient or remove the unused Eloquent user provider, and delete unused UserFactory.",
-            "remediation": "Remove the App\\Models\\User import and reference Infra\\Database\\Models\\ApiClient::class if an authenticatable model is needed, or remove the unused provider.",
-            "verification_notes": "Searched the codebase; confirmed no App\\Models\\User class exists.",
+            "remediation": "Replaced User::class with Infra\\Database\\Models\\ApiClient::class in config/auth.php and deleted unused UserFactory.php.",
+            "verification_notes": "Verified config/auth.php now references valid ApiClient model.",
             "metadata": {
                 "priority": "p2",
                 "subsystem": "CFG"