diff --git a/README.md b/README.md
index dd09ee6..a110ce1 100644
--- a/README.md
+++ b/README.md
@@ -417,12 +417,32 @@ secret) are gitignored and survive pulls; static pages are bind-mounted from the
 `sudo vanguard-deploy rollback` checks out the previously deployed revision and applies the reverse diff.
 `sudo vanguard-deploy status` shows revisions, auto mode, pending restarts, live streams.
 
+**One-time rollout** (the last scp-style deploy; afterwards the server pulls). From the dev box:
+
+    cd ~/claudevs/vanguard-stream && git push
+    scp bin/dumpd.py debian@HOST:~/vanguard-stream/bin/
+    scp systemd/deploy-pending.service systemd/deploy-pending.timer debian@HOST:~/vanguard-stream/systemd/
+    scp configure.py deploy.sh switchToClone.sh check.sh install.sh README.md STATUS.md CommunityDiscordMedia.md debian@HOST:~/vanguard-stream/
+    ssh -t debian@HOST 'cd ~/vanguard-stream && sudo apt-get install -y -q git nodejs npm rsync python3-yaml >/dev/null && sudo install -m 0755 bin/dumpd.py /usr/local/bin/ && ./configure.py --apply >/dev/null && sudo systemctl restart dumpd && sudo vanguard-deploy status'
+
+Then switch the server folder to a clone (two steps):
+
+    ssh -t debian@HOST 'cd ~/vanguard-stream && ./switchToClone.sh key'       # prints a public key
+    # Gitea → repo → Settings → Deploy Keys → add it, read-only
+    ssh -t debian@HOST 'cd ~/vanguard-stream && ./switchToClone.sh clone && cd ~/vanguard-stream && ./configure.py --apply >/dev/null && sudo vanguard-deploy status'
+
+`switchToClone.sh clone` keeps `.env`, the generated configs, the token secret, plugin zips and `bot/app`, and
+leaves the old copy at `~/vanguard-stream.old` until you delete it. From here on a manual deploy is
+`sudo vanguard-deploy pull` on the server.
+
 **Automatic**: Gitea → repo → Settings → Webhooks → Gitea, URL `http://<docker gateway>:8081/deploy`
 (`docker network inspect vanguard-stream_default -f '{{(index .IPAM.Config 0).Gateway}}'`, usually `172.18.0.1`),
 secret = `DEPLOY_WEBHOOK_SECRET` from `.env`, push events, branch `main`. dumpd verifies the HMAC and runs
 `vanguard-deploy pull` **only when `DEPLOY_AUTO=1`** in `.env` (then `./configure.py --apply` to push the setting
-to `/etc/vanguard/deploy.env`). Until then every push is logged (`journalctl -u dumpd | grep deploy`) and ignored.
-Optional `DEPLOY_NOTIFY_WEBHOOK_URL` posts deploy results to Discord.
+to `/etc/vanguard/deploy.env`). Until then every push is logged (`journalctl -u dumpd | grep deploy`) and ignored; Gitea's "test delivery"
+should get a 202 "auto-deploy disabled" back. Optional `DEPLOY_NOTIFY_WEBHOOK_URL` posts deploy results to Discord.
+Turning it on: `DEPLOY_AUTO=1` in `.env`, `./configure.py --apply`, and
+`git mv .gitea/draft-workflows/ci.yml .gitea/workflows/ci.yml` for CI.
 
 CI: `.gitea/draft-workflows/ci.yml` (inert until moved to `.gitea/workflows/`) runs `check.sh` and the plugin
 tests/build on the Actions runner. The runner never deploys — it must not touch the host.