diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..b9ae881
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,10 @@
+{
+  "permissions": {
+    "allow": [
+      "Skill(job-application-assistant)",
+      "Bash(bun run:*)",
+      "Bash(python salary_lookup.py:*)",
+      "Bash(python3 salary_lookup.py:*)"
+    ]
+  }
+}
diff --git a/.claude/settings.local.json b/.claude/settings.local.json
deleted file mode 100644
index 388e737..0000000
--- a/.claude/settings.local.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Skill(job-application-assistant)",
-      "Bash(python3:*)",
-      "Bash(python:*)",
-      "Bash(curl:*)",
-      "Bash(bun:*)"
-    ]
-  }
-}
diff --git a/README.md b/README.md
index dfd0d10..68a9972 100644
--- a/README.md
+++ b/README.md
@@ -117,7 +117,7 @@ ai-job-search/
 │   │   │   └── 07-interview-prep.md   # STAR examples + interview framework
 │   │   ├── job-scraper/               # Job search orchestration
 │   │   └── upskill/                   # /upskill skill gap analysis and learning plan
-│   └── settings.local.json            # Claude Code permissions
+│   └── settings.json                  # Claude Code permissions (shared, scoped)
 ├── .agents/skills/                    # Job portal CLI tools (Denmark)
 │   ├── jobbank-search/                # Akademikernes Jobbank
 │   ├── jobdanmark-search/             # Jobdanmark.dk
diff --git a/SETUP.md b/SETUP.md
index 0421164..b0e1cea 100644
--- a/SETUP.md
+++ b/SETUP.md
@@ -164,3 +164,10 @@ Make sure Bun is installed and you ran `bun install` in each CLI directory. The
 
 ### Fonts not found in cover letter
 The cover letter template expects fonts in `cover_letters/OpenFonts/fonts/`. Make sure this directory exists and contains the Lato and Raleway font files.
+
+### Stale `.claude/settings.local.json` from an older clone
+Shared Claude Code permissions now live in `.claude/settings.json` (scoped to `bun run` and `python salary_lookup.py`). Earlier versions of this repo committed a broader `.claude/settings.local.json` that pre-approved `Bash(curl:*)`, `Bash(python:*)` and `Bash(bun:*)`. If you cloned before that change, git leaves the old file behind in your working copy, and its permissions still apply on top of `settings.json`. Delete it (or trim it to your own personal overrides):
+
+```bash
+rm .claude/settings.local.json
+```