diff --git a/README.md b/README.md
index 98727d7..9ad1dd3 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,9 @@ renders heatmaps, places visited, distance/time statistics, and timeline view.
 
 ## Deploy
 
+Deploys run via **Semaphore** — template `[LXC] Dawarich Deploy` (id 50). Local
+`./deploy.sh` is bootstrap/emergency only.
+
 ```bash
 ./deploy.sh                       # full deploy
 ./deploy.sh --tags dawarich       # dawarich role only
@@ -169,3 +172,6 @@ Pulled from Infisical at deploy time (`infisical.vault.read_secrets` in `site.ym
   No central pg_backup wiring — DB is local.
 - Watchtower exposes its HTTP API on port 8088 inside the LXC (matches the
   fleet pattern; 8080 collides with potential second app on this CT).
+- An `autoheal` sidecar restarts unhealthy containers
+  (`AUTOHEAL_CONTAINER_LABEL=all`) — fleet ops-sidecar standard, so the compose
+  is 6 containers total (app/db/redis/sidekiq + autoheal + watchtower).