diff --git a/mail_forwarding/AGENTS.md b/mail_forwarding/AGENTS.md
index 156e795..c15e219 100644
--- a/mail_forwarding/AGENTS.md
+++ b/mail_forwarding/AGENTS.md
@@ -7,8 +7,8 @@ This directory contains Google Apps Script code configured as Infrastructure as
 It automates the creation of email forwarding in Google Workspace by reading from a Google Sheet and dynamically creating/managing Workspace Groups.
 
 ## Tooling
-- We use `@google/clasp` to manage the deployment of the `.ts` files to Google Apps Script.
-- The entrypoint is `src/Code.ts`.
+- We use `@google/clasp` to manage the deployment of the `.js` files to Google Apps Script. Note: do NOT write TypeScript as we bypass the local transpilation step.
+- The entrypoint is `src/Code.js`.
 - The manifest is `src/appsscript.json`.
 
 ## Rules & Safeguards (CRITICAL)
diff --git a/mail_forwarding/README.md b/mail_forwarding/README.md
index 6728900..5a1cc89 100644
--- a/mail_forwarding/README.md
+++ b/mail_forwarding/README.md
@@ -20,9 +20,9 @@ Before you can deploy, you must authenticate your local machine with your Google
 
 ## Step 2: Configuration
 You must configure the script to point to your specific Google Sheet.
-Open `src/Code.ts` and modify the `CONFIG` block at the top of the file:
+Open `src/Code.js` and modify the `CONFIG` block at the top of the file:
 
-```typescript
+```javascript
 const CONFIG = {
   // 1. The ID of the Google Sheet (found in the URL: https://docs.google.com/spreadsheets/d/<THIS_ID>/edit)
   SPREADSHEET_ID: "YOUR_SHEET_ID_HERE", 
@@ -32,7 +32,7 @@ const CONFIG = {
   
   // 3. The column numbers containing the data (1 = A, 2 = B, 3 = C, etc.)
   COL_SOURCE_ADDRESS: 2, 
-  COL_DESTINATION_ADDRESS: 3, 
+  COL_DESTINATION_ADDRESS: 6, 
   
   // 4. Your admin email for receiving reports
   ADMIN_EMAIL: "admin@haumdaucher.de",
@@ -75,4 +75,12 @@ The code is now in the cloud, but the background triggers need to be activated a
    - Click "Allow" to grant access to the Admin Directory API, Gmail API, and Google Sheets.
 5. Once authorized, the `setup` function will finish executing. It installs the background `onChange` trigger.
 
+## Step 5: Going Live
+By default, the `CONFIG` block has `DRY_RUN: true`. This means the script will parse the sheet, output exactly what it *intends* to do to the logs, and email you a report, but it will **not** actually create, modify, or delete any Google Workspace Groups.
+
+Once you have reviewed the dry-run execution logs and verified that the script correctly parses all rows and maps the email addresses as you expect:
+1. Open `src/Code.js` and change `DRY_RUN: true` to `DRY_RUN: false`.
+2. Run `clasp push` in your terminal to deploy the update.
+3. Edit the spreadsheet one more time to trigger the live sync.
+
 **You are done!** Whenever a new response is submitted to the configured Google Sheet via Forms, the script will automatically run in the background, reconcile the forwarding groups, and send you an email report.
diff --git a/mail_forwarding/package-lock.json b/mail_forwarding/package-lock.json
index 0f78f3c..bb6d6e3 100644
--- a/mail_forwarding/package-lock.json
+++ b/mail_forwarding/package-lock.json
@@ -7,9 +7,6 @@
     "": {
       "name": "haumdaucher-mail-forwarding",
       "version": "1.0.0",
-      "dependencies": {
-        "typescript": "^6.0.3"
-      },
       "devDependencies": {
         "@google/clasp": "^2.4.2",
         "@types/google-apps-script": "^1.0.83"
@@ -3343,19 +3340,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/typescript": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
-      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
     "node_modules/undici-types": {
       "version": "7.19.2",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.19.2.tgz",
diff --git a/mail_forwarding/package.json b/mail_forwarding/package.json
index 74c915a..b84acc4 100644
--- a/mail_forwarding/package.json
+++ b/mail_forwarding/package.json
@@ -9,8 +9,5 @@
   "devDependencies": {
     "@google/clasp": "^2.4.2",
     "@types/google-apps-script": "^1.0.83"
-  },
-  "dependencies": {
-    "typescript": "^6.0.3"
   }
 }
diff --git a/mail_forwarding/src/Code.js b/mail_forwarding/src/Code.js
index 19fbc8c..187a08b 100644
--- a/mail_forwarding/src/Code.js
+++ b/mail_forwarding/src/Code.js
@@ -20,6 +20,9 @@ const CONFIG = {
   // The admin email that should receive the execution reports
   ADMIN_EMAIL: "moritz@haumdaucher.de",
 
+  // The primary Workspace domain for validation and auto-appending
+  WORKSPACE_DOMAIN: "haumdaucher.de",
+
   // Dry run mode. If true, the script will only log what it would do and send the email,
   // but will NOT actually create, update, or delete any groups in Workspace.
   DRY_RUN: true,
@@ -145,12 +148,12 @@ function readDesiredStateFromSheet() {
 
     // 1. Auto-append domain to source if they just typed a name (e.g. "frederic")
     if (source && !source.includes("@")) {
-      source += "@haumdaucher.de";
+      source += `@${CONFIG.WORKSPACE_DOMAIN}`;
     }
 
     // 2. Validate source domain
-    if (source && !source.endsWith("@haumdaucher.de")) {
-      console.warn(`Row ${i + 1}: Skipped. Source address must belong to @haumdaucher.de domain. Found: '${source}'`);
+    if (source && !source.endsWith(`@${CONFIG.WORKSPACE_DOMAIN}`)) {
+      console.warn(`Row ${i + 1}: Skipped. Source address must belong to @${CONFIG.WORKSPACE_DOMAIN} domain. Found: '${source}'`);
       continue;
     }