diff --git a/README.md b/README.md
index 73a59cf..3d89326 100644
--- a/README.md
+++ b/README.md
@@ -208,15 +208,23 @@ the 500 Mbps line. For a crowd, restream to Twitch from OBS.
 
 ## 5g. Authentik forward-auth for the Caddy-gated hosts (`live.`, `bot.`; later the main host)
 
-Caddy's `forward_auth` asks Authentik's **embedded outpost** (127.0.0.1:9000). Authentik needs, once:
-1. Applications → Outposts → edit "authentik Embedded Outpost" → config `authentik_host: https://auth.HOST`
-   (so login redirects go to the public address).
-2. Per protected hostname: Applications → Create with provider → **Proxy Provider**, authorization flow
-   implicit-consent, mode **Forward auth (single application)**, external host `https://live.HOST`
-   (and again for `https://bot.HOST`). Bind groups on the Application (none = anyone who can log in).
-3. Edit the Embedded Outpost → Applications → select them → Update.
-4. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://live.HOST/me/stream-key`
-   shows your username (proves the identity header reaches the backend).
+Caddy's `forward_auth` asks Authentik's **embedded outpost** (127.0.0.1:9000) on every request. The
+generated Caddy blocks work with either Authentik mode below; nothing in Caddy changes.
+
+**Recommended: one domain-level provider for all hosts** (one login, one cookie, new hosts need no Authentik work):
+1. Applications → Outposts → edit "authentik Embedded Outpost" → config `authentik_host: https://auth.HOST`.
+2. Applications → Create with provider → Application `Vanguard sites`; **Proxy Provider**, authorization flow
+   implicit-consent, mode **Forward auth (domain level)**, authentication URL `https://auth.HOST`,
+   cookie domain `HOST's parent domain` (e.g. `dumpstervigilantes.rip`).
+3. Edit the Embedded Outpost → Applications → add `Vanguard sites` → Update.
+4. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://bot.HOST/` opens with no
+   second login; `https://live.HOST/me/stream-key` shows your username.
+
+Trade-off: one access policy for every gated host (the guild policy at login already limits it to server
+members). A host that must be restricted to a group gets its own **single-application** Proxy Provider
+(external host `https://x.HOST`, added to the outpost) and enforces nothing else; the bot web UI also
+authorizes by the `X-Authentik-Groups` header itself.
+
 Jellyfin and Gitea use OIDC providers instead, not this.
 
 ## 6. Editors