diff --git a/CLAUDE.md b/CLAUDE.md
index fe250e7..c6c8dbb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -30,10 +30,19 @@ nobody exercises are options nobody tests.
 
 ## Authentication
 
-**Two login paths, and they must agree.** `ChiAuthLoginMiddleware` (header SSO) and
-`ChiAuthBackend` (password) are separate code that answers the same questions — does this
-user exist, may they in, do we create them. Issue #8 was those two drifting apart for
-years. When you change one, check the other.
+**CHI Auth signs people in one way: header SSO.** `ChiAuthLoginMiddleware` is the only
+code that decides whether a CHI Auth user exists here, may come in, or gets created.
+Until 5.0.0 `ChiAuthBackend` answered the same questions on a password path, and issue #8
+was the two drifting apart for years. No deployment used the backend, so #9 deleted it
+rather than keep reconciling them. Don't bring a second path back without a consumer that
+needs it.
+
+**The local form stays, for local accounts.** With `CHI_AUTH_USE_MIDDLEWARE` off — the
+package default, and how daedalus and monitor run in development — `login_view` renders
+`login.html` and authenticates through Django's `ModelBackend`. `/admin/login/` uses the
+same backend, and it is the documented way in for a local superuser. `user_manager.E003`
+catches a consumer still listing the removed backend, because that fails at sign-in, not
+at startup.
 
 **Usernames match with `__iexact`, and the stored spelling is never rewritten.** The
 directory behind CHI Auth is case-insensitive and the `SSO-Username` header carries
diff --git a/README.md b/README.md
index b831f39..01e6f99 100644
--- a/README.md
+++ b/README.md
@@ -19,23 +19,21 @@ boundary is — so pick it first and read the matching section below.
 | what secures it | **the network** — see “Header based SSO” | Django’s own session and CSRF handling |
 | used by | every CHI deployment | development, and non-CHI deployments |
 
-Within local login, `AUTHENTICATION_BACKENDS` decides *which* credentials the form accepts:
-Django’s `ModelBackend` alone for local passwords only, plus `ChiAuthBackend` to accept UC
-or CHI credentials as well. `CHI_AUTH_CHECK_SYSTEMS` then narrows that further — set it to
-`"local"` to accept CHI accounts while leaving UC Active Directory out of it entirely.
+Local login accepts **local accounts only**, through Django’s own `ModelBackend`. UC and CHI
+credentials are CHI Auth’s to check, on its own page, under header SSO. Until 5.0.0 a
+`ChiAuthBackend` let the local form accept them too; no deployment used it (issue #9).
 
 Supports Django 6.0 and 6.1 on Python 3.12+.
 
-Projects using it: daedalus, ocr_importer, monitor, neurords, rap_subsystem, fcc_tracker,
-email_service, covidicus. Daedalus is the most recently updated and is the best worked
-example to copy from.
+Projects using it: daedalus, email_service and monitor, all deployed on chi-cetus.
+email_service is the best worked example to copy from.
 
 ## Setup
 
 Install from GitHub with pip
 
 ```shell
-pip install "user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.1"
+pip install "user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v5.0.0"
 ```
 
 Check the tag against the latest release — this snippet is hand-maintained and has been
@@ -43,7 +41,7 @@ stale before.
 
 or add to a `requirements.txt` file
 ```
-user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.1
+user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v5.0.0
 ```
 
 Add `user_manager` app to your installed apps
@@ -60,17 +58,9 @@ Set the user manager model as your User model
 AUTH_USER_MODEL = "user_manager.User"
 ```
 
-Select the authentication backends you want to use
-```python
-# select auth backends to use when authenticating inside the app for development
-# the following will first try local authentication, then try CHI Auth authentication
-# checking both CHI Accounts and UC AD Accounts. On successful CHI Auth authentication,
-# the local user will be created if they don’t exist yet.
-AUTHENTICATION_BACKENDS = [
-    "django.contrib.auth.backends.ModelBackend",
-    "user_manager.authentication_backends.ChiAuthBackend",
-]
-```
+Leave `AUTHENTICATION_BACKENDS` at Django’s default, `ModelBackend`. It is what the local
+form and `/admin/login/` authenticate against. Listing the removed
+`user_manager.authentication_backends.ChiAuthBackend` is `user_manager.E003`.
 
 Define an abstract user
 - `user_manager` uses this as the base to build its concrete `User` model, so this is where you add any custom fields or methods.
@@ -86,7 +76,7 @@ class AbstractCustomUser(AbstractUser):
         abstract = True
 ```
 
-Register the context processor, so the login page can see `SITE_TITLE`, `CONTACT_EMAIL` and the CHI Auth help links. Without this the login page still renders, but with those values blank.
+Register the context processor, so the login page can see `SITE_TITLE`, `CONTACT_EMAIL` and `ASSETS_URL`. Without this the login page still renders, but with those values blank.
 
 ```python
 TEMPLATES = [
@@ -119,21 +109,9 @@ environment itself, the same way it does for everything else it configures, so t
 # user_manager.W007.
 CHI_AUTH_URL = "/auth/"
 
-# you need to provide an access token if using CHI_Auth
-CHI_AUTH_API_ACCESS_TOKEN = "🤫"
-
-# Which CHI_AUTH systems do you want to use for authentication, in order?
-# ucad is UC Active Directory, local is CHI_AUTH credentials for non-UC users.
-# The order decides which one authenticates a password when an account exists in both,
-# not merely which is asked first. Set it to "local" to turn UC AD off altogether.
-CHI_AUTH_CHECK_SYSTEMS = 'ucad, local'
-
-# Provision a local account for someone CHI_AUTH authenticates but this app has never
-# seen? Applies to both login paths. Defaults True; set False for closed provisioning.
+# Provision a local account for someone CHI_AUTH signs in but this app has never seen?
+# Read by the header SSO middleware. Defaults True; set False for closed provisioning.
 CHI_AUTH_AUTOCREATE_LOCAL_USER = True
-
-# seconds to wait on any call out to CHI Auth before giving up and failing the login
-CHI_AUTH_TIMEOUT = 5
 ```
 
 Set login/logout paths. These are the same in both modes — under header SSO the login view
@@ -161,9 +139,6 @@ SITE_TITLE = "Center for Health Informatics"
 # who to email for help
 CONTACT_EMAIL = "combmichi@uc.edu"
 
-# where to change a UC password
-UC_PASSWORD_MANAGER_URL = "https://www.uc.edu/sspr"
-
 # base URL of the shared CHI asset library, trailing slash included — the sign-in
 # page links its stylesheet and favicon from here. Set it to "/assets/" where the
 # library is served from this same host, and the assets stop being cross-origin.
@@ -383,6 +358,29 @@ MIDDLEWARE = [..., "user_manager.middleware.InspectHeadersMiddleware"]
 SPECIAL_LOG_FOLDER = "/var/log/myproject/"
 ```
 
+## Upgrading from 4.0 to 5.0
+
+**`ChiAuthBackend` is gone** (#9). It let the local sign-in form accept UC and CHI
+credentials by calling CHI Auth’s `api/authenticate`. Every consumer signs CHI users in
+through header SSO instead, so in production it authenticated no one. The local form stays,
+for local accounts through `ModelBackend` — which is how development signs in, and what
+`/admin/login/` uses.
+
+In each consumer, in the same change as the pin bump:
+
+- **Delete `"user_manager.authentication_backends.ChiAuthBackend"` from
+  `AUTHENTICATION_BACKENDS`.** Left in, every sign-in fails importing it, so
+  `user_manager.E003` makes `manage.py check` — and `migrate` — fail instead. That stops the
+  deploy only where the entrypoint runs under `set -e`; email_service’s does not today, so
+  check it by hand there.
+- **Delete `CHI_AUTH_API_ACCESS_TOKEN`, `CHI_AUTH_CHECK_SYSTEMS` and `CHI_AUTH_TIMEOUT`**
+  from `settings.py`, `example.settings.env` and the deployed `settings.env`. Nothing reads
+  them now; `user_manager.W009` names any still set.
+- `UC_PASSWORD_MANAGER_URL` and the `ACCOUNT_LOOKUP_URL` / `allow_chi_auth_login` context
+  variables are gone with it. No consumer template used them.
+
+A consumer still on 3.2 takes the 4.0 notes below as well.
+
 ## Upgrading from 4.0.0 to 4.0.1
 
 - **The sign-in page no longer carries an inline `<style>`.** It came from the shipped
diff --git a/pyproject.toml b/pyproject.toml
index 077ef9b..ca9e762 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -36,7 +36,6 @@ dependencies = [
     # is one release of slack, not a version anyone runs. 5.2 was dropped in 4.0.0 —
     # it was never exercised by any deployment and kept the Python floor at 3.10.
     "Django>=6.0,<7",
-    "requests",
 ]
 
 [project.urls]
diff --git a/tests/settings.py b/tests/settings.py
index 3088750..421e6c1 100644
--- a/tests/settings.py
+++ b/tests/settings.py
@@ -35,7 +35,6 @@
 
 AUTHENTICATION_BACKENDS = [
     "django.contrib.auth.backends.ModelBackend",
-    "user_manager.authentication_backends.ChiAuthBackend",
 ]
 
 ROOT_URLCONF = "tests.urls"
diff --git a/tests/test_backends.py b/tests/test_backends.py
deleted file mode 100644
index af71a0f..0000000
--- a/tests/test_backends.py
+++ /dev/null
@@ -1,139 +0,0 @@
-from unittest import mock
-
-import requests
-from django.contrib.auth import authenticate, get_user_model
-from django.test import TestCase, override_settings
-
-from user_manager.authentication_backends import ChiAuthBackend
-
-User = get_user_model()
-
-REMOTE_USER = {
-    "username": "ada",
-    "email": "ada@example.com",
-    "first_name": "Ada",
-    "last_name": "Lovelace",
-}
-
-
-def fake_response(payload=None, status_code=200, json_error=False):
-    response = mock.Mock(status_code=status_code)
-    if json_error:
-        response.json.side_effect = ValueError("not json")
-    else:
-        response.json.return_value = payload
-    return response
-
-
-def patch_get(**kwargs):
-    return mock.patch("user_manager.authentication_backends.requests.get", **kwargs)
-
-
-class ChiAuthBackendTests(TestCase):
-    def setUp(self):
-        self.backend = ChiAuthBackend()
-
-    def test_no_credentials_makes_no_request(self):
-        with patch_get() as get:
-            self.assertIsNone(self.backend.authenticate(None, username="", password=""))
-        get.assert_not_called()
-
-    def test_existing_user_authenticates(self):
-        user = User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": True})):
-            self.assertEqual(self.backend.authenticate(None, "ada", "pw"), user)
-
-    def test_wrong_password_is_rejected(self):
-        User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": False})):
-            self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-
-    def test_inactive_user_is_rejected_without_calling_chi_auth(self):
-        """Deactivating an account must lock it out even while the UC credentials work."""
-        User.objects.create_user(username="ada", is_active=False)
-        with patch_get(return_value=fake_response({"authenticated": True})) as get:
-            self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-        get.assert_not_called()
-
-    @override_settings(CHI_AUTH_AUTOCREATE_LOCAL_USER=False)
-    def test_unknown_user_is_rejected_when_autocreate_is_off(self):
-        # explicit since 4.0.0, where the default flipped to True — see issue #8
-        with patch_get() as get:
-            self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-        get.assert_not_called()
-
-    def test_the_username_is_matched_case_insensitively(self):
-        """Issue #3: an exact match would authenticate "Ada" against a case-insensitive
-        directory and then provision a second account beside the existing "ada".
-        """
-        user = User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": True})):
-            self.assertEqual(self.backend.authenticate(None, "Ada", "pw"), user)
-        self.assertEqual(User.objects.count(), 1)
-
-    @override_settings(CHI_AUTH_AUTOCREATE_LOCAL_USER=True)
-    def test_unknown_user_is_created_when_autocreate_is_on(self):
-        payload = {"authenticated": True, "user": REMOTE_USER}
-        with patch_get(return_value=fake_response(payload)):
-            user = self.backend.authenticate(None, "ada", "pw")
-
-        self.assertIsNotNone(user)
-        self.assertEqual(user.email, "ada@example.com")
-        self.assertEqual(user.first_name, "Ada")
-        self.assertEqual(user.last_name, "Lovelace")
-        self.assertFalse(user.has_usable_password())
-
-    @override_settings(CHI_AUTH_AUTOCREATE_LOCAL_USER=True)
-    def test_autocreate_tolerates_a_response_with_no_user_details(self):
-        with patch_get(return_value=fake_response({"authenticated": True})):
-            user = self.backend.authenticate(None, "ada", "pw")
-        self.assertEqual(user.username, "ada")
-
-    def test_network_failure_is_a_failed_login_not_an_exception(self):
-        User.objects.create_user(username="ada")
-        with patch_get(side_effect=requests.Timeout("too slow")):
-            with self.assertLogs("user_manager.authentication_backends", "WARNING"):
-                self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-
-    def test_non_json_response_is_a_failed_login_not_an_exception(self):
-        User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response(status_code=502, json_error=True)):
-            with self.assertLogs("user_manager.authentication_backends", "WARNING"):
-                self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-
-    @override_settings(CHI_AUTH_TIMEOUT=1.5, CHI_AUTH_URL="https://auth.test/")
-    def test_request_uses_the_configured_timeout_and_url(self):
-        User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": True})) as get:
-            self.backend.authenticate(None, "ada", "pw")
-
-        args, kwargs = get.call_args
-        self.assertEqual(args[0], "https://auth.test/api/authenticate")
-        self.assertEqual(kwargs["timeout"], 1.5)
-        self.assertEqual(kwargs["headers"]["x-password"], "pw")
-
-    def test_get_user_rejects_inactive_users(self):
-        user = User.objects.create_user(username="ada")
-        self.assertEqual(self.backend.get_user(user.pk), user)
-        User.objects.filter(pk=user.pk).update(is_active=False)
-        self.assertIsNone(self.backend.get_user(user.pk))
-        self.assertIsNone(self.backend.get_user(user.pk + 1000))
-
-
-class AuthenticateIntegrationTests(TestCase):
-    """django.contrib.auth.authenticate() walks AUTHENTICATION_BACKENDS, and tags the
-    returned user with the backend that succeeded — which is what login() then stores.
-    """
-
-    def test_backend_attribute_is_set_by_chi_auth(self):
-        User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": True})):
-            user = authenticate(None, username="ada", password="pw")
-        self.assertEqual(user.backend, "user_manager.authentication_backends.ChiAuthBackend")
-
-    def test_model_backend_still_wins_for_local_passwords(self):
-        User.objects.create_user(username="ada", password="hunter2")
-        with patch_get() as get:
-            user = authenticate(None, username="ada", password="hunter2")
-        self.assertEqual(user.backend, "django.contrib.auth.backends.ModelBackend")
-        get.assert_not_called()
diff --git a/tests/test_settings_and_checks.py b/tests/test_settings_and_checks.py
index 181e5e4..dc62462 100644
--- a/tests/test_settings_and_checks.py
+++ b/tests/test_settings_and_checks.py
@@ -8,6 +8,7 @@
 from user_manager.checks import (
     check_chi_auth_middleware,
     check_migration_modules,
+    check_removed_in_5,
     check_username_case_collisions,
 )
 from user_manager.context_processors import settings_context_processor
@@ -22,13 +23,11 @@
 
 class GetSettingTests(SimpleTestCase):
     def test_default_is_used_when_nothing_is_configured(self):
-        # "ucad, local" since 4.0.0 — the order all four deployed consumers set, and it
-        # decides which directory authenticates a password, not just which is asked first
-        self.assertEqual(custom_settings.CHI_AUTH_CHECK_SYSTEMS, "ucad, local")
+        self.assertEqual(custom_settings.SITE_TITLE, "Center for Health Informatics")
 
-    @override_settings(CHI_AUTH_CHECK_SYSTEMS="local")
+    @override_settings(SITE_TITLE="Daedalus")
     def test_django_setting_wins(self):
-        self.assertEqual(custom_settings.CHI_AUTH_CHECK_SYSTEMS, "local")
+        self.assertEqual(custom_settings.SITE_TITLE, "Daedalus")
 
     def test_the_environment_is_not_a_configuration_surface(self):
         """settings.py is the only place a setting comes from, as of 4.0.0 (issue #17).
@@ -38,8 +37,8 @@ def test_the_environment_is_not_a_configuration_surface(self):
         latency for three services through a surface no repository documented.
         """
         for name, raw in [
-            ("CHI_AUTH_CHECK_SYSTEMS", "ucad"),
-            ("CHI_AUTH_TIMEOUT", "30"),
+            ("CHI_AUTH_URL", "https://elsewhere.example/auth/"),
+            ("CHI_AUTH_AUTOCREATE_LOCAL_USER", "False"),
             ("USER_MANAGER_ABSTRACT_USER_MODEL", "somewhere.else.Model"),
         ]:
             with self.subTest(name=name):
@@ -76,10 +75,6 @@ def test_autocreate_defaults_on(self):
         """
         self.assertIs(custom_settings.CHI_AUTH_AUTOCREATE_LOCAL_USER, True)
 
-    @override_settings(CHI_AUTH_TIMEOUT="2.5")
-    def test_timeout_is_cast_to_a_number(self):
-        self.assertEqual(custom_settings.CHI_AUTH_TIMEOUT, 2.5)
-
     @override_settings(CHI_AUTH_TRUSTED_PROXIES="10.0.0.1, 10.0.0.2")
     def test_trusted_proxies_are_split(self):
         self.assertEqual(custom_settings.CHI_AUTH_TRUSTED_PROXIES, ["10.0.0.1", "10.0.0.2"])
@@ -88,20 +83,19 @@ def test_unknown_setting_raises(self):
         with self.assertRaises(AttributeError):
             _ = custom_settings.NOT_A_SETTING
 
+    def test_settings_only_chi_auth_backend_read_are_gone(self):
+        """Removed with it in 5.0.0 (issue #9), rather than left resolvable and unread."""
+        for name in [
+            "CHI_AUTH_API_ACCESS_TOKEN",
+            "CHI_AUTH_CHECK_SYSTEMS",
+            "CHI_AUTH_TIMEOUT",
+            "UC_PASSWORD_MANAGER_URL",
+        ]:
+            with self.subTest(name=name), self.assertRaises(AttributeError):
+                getattr(custom_settings, name)
 
-class ContextProcessorTests(SimpleTestCase):
-    def test_chi_auth_links_are_shown_when_the_backend_is_installed(self):
-        context = settings_context_processor(None)
-        self.assertTrue(context["allow_chi_auth_login"])
-        # relative, because CHI_AUTH_URL is: the link has to stay on the host the user
-        # is already signed in to
-        self.assertEqual(context["ACCOUNT_LOOKUP_URL"], "/auth/account_lookup")
-
-    @override_settings(CHI_AUTH_URL="https://chi.uc.edu/auth/")
-    def test_account_lookup_url_still_honours_an_absolute_setting(self):
-        context = settings_context_processor(None)
-        self.assertEqual(context["ACCOUNT_LOOKUP_URL"], "https://chi.uc.edu/auth/account_lookup")
 
+class ContextProcessorTests(SimpleTestCase):
     def test_assets_url_is_exposed_to_the_sign_in_template(self):
         self.assertEqual(
             settings_context_processor(None)["ASSETS_URL"], "https://chi.uc.edu/assets/"
@@ -111,9 +105,37 @@ def test_assets_url_is_exposed_to_the_sign_in_template(self):
     def test_assets_url_can_be_overridden(self):
         self.assertEqual(settings_context_processor(None)["ASSETS_URL"], "/assets/")
 
-    @override_settings(AUTHENTICATION_BACKENDS=["django.contrib.auth.backends.ModelBackend"])
-    def test_chi_auth_links_are_hidden_otherwise(self):
-        self.assertFalse(settings_context_processor(None)["allow_chi_auth_login"])
+    def test_no_links_for_the_removed_password_path(self):
+        """The UC and CHI password links only made sense beside ChiAuthBackend. The form
+        is for local accounts now; CHI Auth users never see it (issue #9)."""
+        context = settings_context_processor(None)
+        for name in ["allow_chi_auth_login", "UC_PASSWORD_MANAGER_URL", "ACCOUNT_LOOKUP_URL"]:
+            with self.subTest(name=name):
+                self.assertNotIn(name, context)
+
+
+class RemovedIn5ChecksTests(SimpleTestCase):
+    def ids(self, **settings_kwargs):
+        with override_settings(**settings_kwargs):
+            return [message.id for message in check_removed_in_5(None)]
+
+    def test_silent_on_a_converted_project(self):
+        self.assertEqual(self.ids(), [])
+
+    def test_errors_while_the_backend_is_still_listed(self):
+        """An Error, not a Warning: the dotted path is only imported at sign-in, so a
+        missed one fails every login — /admin/login/ included — after a healthy deploy."""
+        backends = [
+            "django.contrib.auth.backends.ModelBackend",
+            "user_manager.authentication_backends.ChiAuthBackend",
+        ]
+        self.assertEqual(self.ids(AUTHENTICATION_BACKENDS=backends), ["user_manager.E003"])
+
+    def test_warns_about_settings_nothing_reads_any_more(self):
+        with override_settings(CHI_AUTH_CHECK_SYSTEMS="ucad, local", CHI_AUTH_TIMEOUT=5):
+            messages = check_removed_in_5(None)
+        self.assertEqual([m.id for m in messages], ["user_manager.W009"])
+        self.assertIn("CHI_AUTH_CHECK_SYSTEMS, CHI_AUTH_TIMEOUT", messages[0].msg)
 
 
 class ChecksTests(SimpleTestCase):
diff --git a/user_manager/__init__.py b/user_manager/__init__.py
index 76ad18b..ba7be38 100644
--- a/user_manager/__init__.py
+++ b/user_manager/__init__.py
@@ -1 +1 @@
-__version__ = "4.0.1"
+__version__ = "5.0.0"
diff --git a/user_manager/authentication_backends.py b/user_manager/authentication_backends.py
deleted file mode 100644
index 904380a..0000000
--- a/user_manager/authentication_backends.py
+++ /dev/null
@@ -1,104 +0,0 @@
-import logging
-
-import requests
-from django.contrib.auth import get_user_model
-from django.contrib.auth.backends import BaseBackend
-
-from . import custom_settings as settings
-
-logger = logging.getLogger(__name__)
-
-
-class ChiAuthBackend(BaseBackend):
-    """
-    Authenticates against UC’s AD using the CHI Auth API.
-
-    1. If user does not exist here already, they will not be created
-       (unless CHI_AUTH_AUTOCREATE_LOCAL_USER is on).
-    2. The api/authenticate call is just a proxy for UC’s LDAP system.
-       It only cares if the username/PW matches in LDAP, not how that user is
-       defined locally on the SSO site.
-    """
-
-    def authenticate(self, request, username=None, password=None, **kwargs):
-        if not username or not password:
-            return None
-        UserModel = get_user_model()
-        # __iexact: the directory behind CHI Auth is case-insensitive, so an exact match
-        # here would authenticate "JSmith" against CHI Auth and then provision a second
-        # local account alongside the existing "jsmith". See checks.py W008.
-        oUser = UserModel.objects.filter(username__iexact=username).first()
-
-        # if no user and we’re not autocreating users, can quit here
-        if oUser is None and not settings.CHI_AUTH_AUTOCREATE_LOCAL_USER:
-            return None
-        # a deactivated account stays locked out even when the remote credentials still work
-        if oUser is not None and not self.user_can_authenticate(oUser):
-            return None
-
-        response = self._call_api(username, password)
-        if not response or not response.get("authenticated"):
-            return None
-
-        # if user exists locally and they authenticated, we’re good
-        if oUser:
-            return oUser
-
-        # if we’re autocreating and we authenticated a user that doesn’t exist, create them
-        remote_user = response.get("user") or {}
-        return UserModel.objects.create_user(
-            # CHI Auth's own spelling of the username wins over what was typed at the form
-            username=remote_user.get("username", username),
-            email=remote_user.get("email", ""),
-            first_name=remote_user.get("first_name", ""),
-            last_name=remote_user.get("last_name", ""),
-        )
-
-    def _call_api(self, username, password):
-        """Ask CHI Auth whether these credentials are valid. Returns the decoded response,
-        or None if CHI Auth could not be reached or answered with something unusable —
-        either way the caller treats it as a failed login rather than raising.
-        """
-        payload = {
-            "username": username,
-            "systems": settings.CHI_AUTH_CHECK_SYSTEMS,
-        }
-        headers = {
-            "x-password": password,
-            "x-access-token": settings.CHI_AUTH_API_ACCESS_TOKEN,
-        }
-        try:
-            r = requests.get(
-                settings.CHI_AUTH_URL + "api/authenticate",
-                params=payload,
-                headers=headers,
-                timeout=settings.CHI_AUTH_TIMEOUT,
-            )
-        except requests.RequestException:
-            logger.warning("CHI Auth could not be reached", exc_info=True)
-            return None
-
-        try:
-            return r.json()
-        except ValueError:
-            logger.warning("CHI Auth returned a non-JSON response (HTTP %s)", r.status_code)
-            return None
-
-    # this is just a copy of the default
-    # get_user method from django.contrib.auth.backends.ModelBackend
-    # (BaseBackend.get_user is only a stub that returns None)
-    def get_user(self, user_id):
-        UserModel = get_user_model()
-        try:
-            user = UserModel._default_manager.get(pk=user_id)
-        except UserModel.DoesNotExist:
-            return None
-        return user if self.user_can_authenticate(user) else None
-
-    def user_can_authenticate(self, user):
-        """
-        Reject users with is_active=False. Custom user models that don’t have
-        that attribute are allowed.
-        """
-        is_active = getattr(user, "is_active", None)
-        return is_active or is_active is None
diff --git a/user_manager/checks.py b/user_manager/checks.py
index 39c724b..851f617 100644
--- a/user_manager/checks.py
+++ b/user_manager/checks.py
@@ -16,6 +16,9 @@
 AUTH_MIDDLEWARE = "django.contrib.auth.middleware.AuthenticationMiddleware"
 CHI_AUTH_MIDDLEWARE = "user_manager.middleware.ChiAuthLoginMiddleware"
 INSPECT_MIDDLEWARE = "user_manager.middleware.InspectHeadersMiddleware"
+REMOVED_BACKEND = "user_manager.authentication_backends.ChiAuthBackend"
+# read only by ChiAuthBackend's call to CHI Auth's api/authenticate, removed in 5.0.0
+REMOVED_SETTINGS = ["CHI_AUTH_API_ACCESS_TOKEN", "CHI_AUTH_CHECK_SYSTEMS", "CHI_AUTH_TIMEOUT"]
 
 
 @register()
@@ -40,6 +43,41 @@ def check_migration_modules(app_configs, **kwargs):
     ]
 
 
+@register()
+def check_removed_in_5(app_configs, **kwargs):
+    """ChiAuthBackend is gone (issue #9): every consumer signs in through header SSO, and
+    the local form authenticates with Django's own ModelBackend.
+
+    Left in AUTHENTICATION_BACKENDS, the dotted path is only imported when someone signs in
+    — so every sign-in, /admin/login/ included, would fail with an ImportError long after
+    the deploy looked healthy. An Error here fails `migrate` instead, and with it the
+    deploy of any entrypoint running under `set -e`.
+    """
+    messages = []
+    if REMOVED_BACKEND in getattr(settings, "AUTHENTICATION_BACKENDS", []):
+        messages.append(
+            Error(
+                f"{REMOVED_BACKEND} was removed in user_manager 5.0.0, but "
+                f"AUTHENTICATION_BACKENDS still lists it. Every sign-in would fail importing it.",
+                hint="Delete it from AUTHENTICATION_BACKENDS. CHI Auth users arrive through "
+                "ChiAuthLoginMiddleware; the local form uses ModelBackend.",
+                id="user_manager.E003",
+            )
+        )
+    leftover = [name for name in REMOVED_SETTINGS if hasattr(settings, name)]
+    if leftover:
+        messages.append(
+            Warning(
+                f"Set, but read by nothing since user_manager 5.0.0 removed "
+                f"ChiAuthBackend: {', '.join(leftover)}.",
+                hint="Delete them from settings.py and from the deployment's settings.env, "
+                "so nothing appears configurable that is not.",
+                id="user_manager.W009",
+            )
+        )
+    return messages
+
+
 @register("security")
 def check_chi_auth_middleware(app_configs, **kwargs):
     errors = []
diff --git a/user_manager/context_processors.py b/user_manager/context_processors.py
index 5dab39c..b4efb6f 100644
--- a/user_manager/context_processors.py
+++ b/user_manager/context_processors.py
@@ -1,23 +1,13 @@
-from django.conf import settings
-
 from . import custom_settings
 
 
 def settings_context_processor(request):
-    # determine if CHI Auth is being used
-    allow_chi_auth_login = "user_manager.authentication_backends.ChiAuthBackend" in getattr(
-        settings, "AUTHENTICATION_BACKENDS", []
-    )
-
     my_dict = {
         "LOGIN_URL_FOR_LINK": custom_settings.LOGIN_URL_FOR_LINK,
         "LOGOUT_URL_FOR_LINK": custom_settings.LOGOUT_URL_FOR_LINK,
-        "UC_PASSWORD_MANAGER_URL": custom_settings.UC_PASSWORD_MANAGER_URL,
-        "ACCOUNT_LOOKUP_URL": f"{custom_settings.CHI_AUTH_URL}account_lookup",
         "CONTACT_EMAIL": custom_settings.CONTACT_EMAIL,
         "SITE_TITLE": custom_settings.SITE_TITLE,
         "ASSETS_URL": custom_settings.ASSETS_URL,
-        "allow_chi_auth_login": allow_chi_auth_login,
     }
 
     return my_dict
diff --git a/user_manager/custom_settings.py b/user_manager/custom_settings.py
index f396f3c..0361dd3 100644
--- a/user_manager/custom_settings.py
+++ b/user_manager/custom_settings.py
@@ -50,29 +50,16 @@ def _to_bool(value):
     # not span domains: the cookie and the SSO-* headers are per-domain. See checks.py
     # W007, which warns when this names a host.
     "CHI_AUTH_URL": "/auth/",
-    # you need to provide an access token if using CHI_Auth
-    "CHI_AUTH_API_ACCESS_TOKEN": "",
-    # seconds to wait on any call out to CHI Auth before giving up
-    "CHI_AUTH_TIMEOUT": 5,
     # Provision a local account for a user CHI Auth authenticates but this app has never
-    # seen? True on both login paths — the header SSO middleware and ChiAuthBackend.
+    # seen? Read by the header SSO middleware, the only path CHI Auth signs anyone in by
+    # since 5.0.0 removed ChiAuthBackend.
     #
     # Defaults True because that is what every deployment already does: before 4.0.0 the
     # middleware provisioned unconditionally and never consulted this setting (issue #8),
     # and header SSO is how everyone arrives. A default of False would have turned that
     # into "provisions no one" on the pin bump, silently, for every consumer that had
-    # never set it. A deployment that genuinely wants closed provisioning sets False and
-    # gets it on both paths.
+    # never set it. A deployment that genuinely wants closed provisioning sets False.
     "CHI_AUTH_AUTOCREATE_LOCAL_USER": True,
-    # what credentials should be accepted from CHI Auth? (comma separated string)
-    # local: user account in CHI Auth
-    # ucad: user account in UC Active Directory (only works if server is on UC network)
-    #
-    # The order is not merely which directory is asked first — it decides which one
-    # authenticates a password when an account exists in both. "ucad, local" is what all
-    # four deployed consumers set, so it is the default rather than something each of
-    # them restates.
-    "CHI_AUTH_CHECK_SYSTEMS": "ucad, local",
     # is header SSO in use — an upstream nginx authenticating against CHI Auth and passing
     # identity as SSO-* headers for ChiAuthLoginMiddleware to read? The project is what
     # installs the middleware; this is how the rest of the package knows it did. login_view
@@ -92,7 +79,6 @@ def _to_bool(value):
     "USER_MANAGER_ABSTRACT_USER_MODEL": "project.abstract_user_model.AbstractCustomUser",
     "SITE_TITLE": "Center for Health Informatics",
     "CONTACT_EMAIL": "combmichi@uc.edu",
-    "UC_PASSWORD_MANAGER_URL": "https://www.uc.edu/sspr",
     # Base URL of the shared CHI asset library, trailing slash included; the sign-in
     # template links its stylesheet and favicon from here. Absolute by default so an
     # existing consumer that says nothing keeps the styling it has, but overridable —
@@ -103,7 +89,6 @@ def _to_bool(value):
 
 # settings that need converting when a project supplies them as a string
 CASTS = {
-    "CHI_AUTH_TIMEOUT": float,
     "CHI_AUTH_AUTOCREATE_LOCAL_USER": _to_bool,
     "CHI_AUTH_USE_MIDDLEWARE": _to_bool,
     "CHI_AUTH_TRUSTED_PROXIES": _to_list,
diff --git a/user_manager/middleware.py b/user_manager/middleware.py
index 3033abe..0edf011 100644
--- a/user_manager/middleware.py
+++ b/user_manager/middleware.py
@@ -166,8 +166,8 @@ def get_or_create_user(request, username):
         oUser = User.objects.filter(username__iexact=username).first()
         if not oUser:
             if not custom_settings.CHI_AUTH_AUTOCREATE_LOCAL_USER:
-                # the same answer ChiAuthBackend gives on the password path; before 4.0.0
-                # this path provisioned regardless and the setting meant nothing here
+                # before 4.0.0 this path provisioned regardless and the setting meant
+                # nothing here
                 logger.warning(
                     "Refusing SSO login for unknown user %r: CHI_AUTH_AUTOCREATE_LOCAL_USER is off",
                     username,
diff --git a/user_manager/templates/user_manager/login.html b/user_manager/templates/user_manager/login.html
index 23f85a2..ad43fb9 100644
--- a/user_manager/templates/user_manager/login.html
+++ b/user_manager/templates/user_manager/login.html
@@ -21,13 +21,6 @@ <h1>Sign in to:<br><b>{{ SITE_TITLE }}</b></h1>
     <aside>{{ login_error }}</aside>
     {% endif %}
 
-    {% if allow_chi_auth_login %}
-    <ul>
-      <li><label>faculty, staff, students:</label> <span>sign in with your <b>UC</b> credentials</span></li>
-      <li><label>all others:</label> <span>sign in with your <b>CHI</b> credentials</span></li>
-    </ul>
-    {% endif %}
-
     <form action="" method="POST">
       {% csrf_token %}
       <input type="text" name="username" id="user-id" placeholder="Username" autofocus>
@@ -38,10 +31,6 @@ <h1>Sign in to:<br><b>{{ SITE_TITLE }}</b></h1>
     <footer>
       <h2>Need Help?</h2>
       <ul>
-        {% if allow_chi_auth_login %}
-        <li><a href="{{ UC_PASSWORD_MANAGER_URL }}" target="_blank">Forgot UC Central password</a></li>
-        <li><a href="{{ ACCOUNT_LOOKUP_URL }}">Create CHI account or reset password</a></li>
-        {% endif %}
         <li><a href="mailto:{{ CONTACT_EMAIL }}">Contact CHI</a></li>
       </ul>
     </footer>