diff --git a/server/jellyfin/api.go b/server/jellyfin/api.go
index 6eb8f9098..beb5c6876 100644
--- a/server/jellyfin/api.go
+++ b/server/jellyfin/api.go
@@ -50,8 +50,8 @@ func (api *Router) routes() http.Handler {
 	r.Post("/Users/AuthenticateByName", api.authenticateByName)
 	r.Get("/Users/Public", api.getPublicUsers)
 
-	// Images are intentionally public and not library-scoped: artwork isn't sensitive media
-	// content, and clients (e.g. Finamp) load it via <img> tags with only ?api_key= in the URL.
+	// Images are intentionally fully public and do not require authentication: artwork isn't
+	// sensitive media content, and this matches Jellyfin's lenient image handling.
 	r.Get("/Items/{itemId}/Images/{type}", api.getItemImage)
 	r.Get("/Items/{itemId}/Images/{type}/{index}", api.getItemImage)
 
diff --git a/server/jellyfin/library.go b/server/jellyfin/library.go
index 463df8525..1bf75bd8b 100644
--- a/server/jellyfin/library.go
+++ b/server/jellyfin/library.go
@@ -8,8 +8,8 @@ import (
 )
 
 // accessibleLibraryIDs returns the ids of the libraries the current user can access. An
-// empty result means "no restriction" (e.g. admins), which matches the no-op semantics of
-// filter.ApplyLibraryFilter/ApplyArtistLibraryFilter for an empty id list.
+// empty slice only occurs for the edge case of a non-admin user with no assigned libraries;
+// filter.ApplyLibraryFilter/ApplyArtistLibraryFilter treat it as a no-op (unrestricted).
 func accessibleLibraryIDs(ctx context.Context) []int {
 	u, _ := request.UserFrom(ctx)
 	return u.Libraries.IDs()