diff --git a/README.md b/README.md
index 5bc0c18..9fb9ac2 100644
--- a/README.md
+++ b/README.md
@@ -170,12 +170,19 @@ sudo snap stop --disable docker.dockerd      # if a crashing snap docker is pres
 sudo systemctl enable --now docker.service   # classic engine, on at boot
 docker info | head                           # verify as your user, no sudo
 ```
-Fedora gotcha: if `dockerd` then fails with
-`ZONE_CONFLICT: 'docker0' already bound to 'FedoraWorkstation'` (a stale binding,
-often left by a prior snap-docker), free the interface and retry:
+Fedora gotcha: if `dockerd` fails with
+`ZONE_CONFLICT: 'docker0' already bound to 'FedoraWorkstation'`, the cause is a
+leftover **NetworkManager** bridge profile for `docker0` (no zone set → lands in
+the default zone), which firewalld then re-applies. Delete it, stop NM managing
+Docker's bridges (so it can't recur at boot), and start Docker:
 ```sh
-sudo firewall-cmd --permanent --zone=FedoraWorkstation --remove-interface=docker0
-sudo firewall-cmd --reload && sudo ip link delete docker0 2>/dev/null
+sudo nmcli connection delete docker0
+sudo tee /etc/NetworkManager/conf.d/docker-unmanaged.conf >/dev/null <<'EOF'
+[keyfile]
+unmanaged-devices=interface-name:docker0;interface-name:br-*
+EOF
+sudo systemctl reload NetworkManager
+sudo ip link delete docker0 2>/dev/null
 sudo systemctl reset-failed docker.service && sudo systemctl start docker.service
 ```