diff --git a/README.md b/README.md
index be5115c..d785006 100644
--- a/README.md
+++ b/README.md
@@ -184,15 +184,24 @@ In the `jb-website` repo settings on Forgejo (`Settings → Actions`):
   cat ~/.ssh/jb-deploy        # <- paste this into DEPLOY_SSH_KEY
   ```
 
-On the **VPS**, prepare the deploy target:
+On the **VPS**, put the production compose file in place — rsync it from your
+desktop (creates the dir + copies; only the prod `compose.yml`, not the dev one):
 ```sh
-mkdir -p /opt/jb-website
-# copy jb-website/compose.yml here (the production one — pulls, no build)
-docker login git.joshbairstow.com      # one-time, so `compose pull` can read the package
-# (or mark the jb-website package public in Forgejo to skip VPS login)
+rsync -av --rsync-path="mkdir -p /opt/jb-website && rsync" \
+  ~/git/jb-website/compose.yml root@45.32.242.27:/opt/jb-website/
 ```
-Create a restricted deploy user whose `authorized_keys` holds the public half
-of `DEPLOY_SSH_KEY`.
+For `docker compose pull` to read the image, the **package** must be pullable.
+Note: **package visibility ≠ repository visibility** — packages are owned by the
+user/org, so making the *repo* public does NOT necessarily make the *image*
+anonymously pullable, and the package only exists after the first push. After
+the first pipeline run, verify from the VPS:
+```sh
+docker pull git.joshbairstow.com/<owner>/jb-website:latest
+# unauthorized? -> set the PACKAGE public (profile → Packages → jb-website →
+# settings), or run `docker login git.joshbairstow.com` once as DEPLOY_USER.
+```
+If `DEPLOY_USER` is not root, it must be in the `docker` group; for least
+privilege, restrict its `authorized_keys` entry with a forced `command=`.
 
 ### 7. First deploy
 ```sh