diff --git a/README.md b/README.md
index 914a6ef9..b33f5275 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,8 @@ services:
       - minstrel-data:/data
     environment:
       SMARTMUSIC_DATABASE_URL: postgres://minstrel:minstrel@db:5432/minstrel?sslmode=disable
-      SMARTMUSIC_LIBRARY_ROOT: /music
+      SMARTMUSIC_LIBRARY_SCAN_PATHS: /music
+      SMARTMUSIC_AUTH_ADMIN_USERNAME: admin
     depends_on: [db]
 
   db:
@@ -48,7 +49,7 @@ volumes:
 docker compose up -d
 ```
 
-Open `http://localhost:4533` and complete the first-run admin setup.
+Watch `docker compose logs minstrel` on first start — a one-time admin password is printed to stderr. Sign in at `http://localhost:4533` with username `admin` and that password, then change it under Settings.
 
 For the full configuration surface, see [`config.example.yaml`](./config.example.yaml).
 
@@ -58,10 +59,12 @@ Most operators only need the env vars in the quickstart above. A few extras wort
 
 - `SMARTMUSIC_BRANDING_APP_NAME` — rename the instance ("Family Jukebox", "Office Music"). Surfaces in the header, browser tab, and OG share previews.
 - `SMARTMUSIC_STORAGE_DATA_DIR` — defaults to `./data`. Holds playlist cover collages and other generated artefacts.
-- `SMARTMUSIC_LISTENBRAINZ_TOKEN` — enables ListenBrainz scrobble + similarity. Per-user tokens override the server default in Settings.
-- `SMARTMUSIC_LIDARR_URL` / `SMARTMUSIC_LIDARR_API_KEY` — Lidarr integration. Configure once at the server level; per-user request flows are exposed in the admin UI.
+- `SMARTMUSIC_LIBRARY_SCAN_PATHS` — colon-separated list of music library roots to scan. Supports multiple roots (`/music:/podcasts`).
+- `SMARTMUSIC_AUTH_ADMIN_USERNAME` / `SMARTMUSIC_AUTH_ADMIN_PASSWORD` — bootstrap admin credentials. Leave the password unset to have the server generate one and print it to stderr on first start.
 
-Every yaml key has an equivalent env var (`SMARTMUSIC_<SECTION>_<FIELD>`). See `config.example.yaml` for the full list.
+ListenBrainz integration (per-user scrobble + similarity tokens) and Lidarr integration (URL + API key) are configured through the admin Settings UI rather than env vars or yaml — per Minstrel's "config in UI" rule, integration settings live where operators can edit them without restarting.
+
+Most operational keys have a `SMARTMUSIC_<SECTION>_<FIELD>` env override. Recommendation and events tuning are yaml-only. See [`config.example.yaml`](./config.example.yaml) for the authoritative surface.
 
 ## Updating