diff --git a/custom.css b/custom.css
new file mode 100644
index 0000000..862400d
--- /dev/null
+++ b/custom.css
@@ -0,0 +1,15 @@
+/* redoal - the skin over portal's own stylesheet
+   (site.yaml `stylesheet`, loaded after main.css, so these rules win). */
+
+/* The way in sits beside the wordmark on every page. redoal.com is read
+   and answered without an account, so the invitation is not shown.
+   Whoever edits the site still signs in at /auth/login directly, and
+   once signed in the nav keeps its name and its way out. */
+.session:has(a[href^="/auth/login"]) {
+  display: none;
+}
+
+/* Without :has(), the link alone goes and the empty nav stays. */
+.session a[href^="/auth/login"] {
+  display: none;
+}
diff --git a/site.yaml b/site.yaml
index 62d914a..02c7937 100644
--- a/site.yaml
+++ b/site.yaml
@@ -5,3 +5,4 @@ hero:
   kind: module
   module: hero.js   # this repo's sine-swings piece, served at /site/hero.js
 wordmark_invert: true
+stylesheet: custom.css