diff --git a/README.md b/README.md
index 618e7ac..67bd4bf 100644
--- a/README.md
+++ b/README.md
@@ -38,25 +38,30 @@ custom_component fork that adds `CONF_BASE_URL`).
    Expect: Node 22 installed, `@rynfar/meridian` installed, systemd unit deployed
    and enabled but **not started** (no creds yet — `claude_creds.stat.exists`
    gates the start task).
-4. On Chuck's Mac:
-   ```
-   npm i -g @anthropic-ai/claude-code
-   claude login          # browser flow → ~/.claude/.credentials.json
-   scp -r ~/.claude cbalders@192.168.1.164:/tmp/.claude-bootstrap
-   ```
-5. On the LXC:
-   ```
-   sudo cp -r /tmp/.claude-bootstrap/. /opt/meridian/.claude/
-   sudo chown -R meridian:meridian /opt/meridian/.claude/
-   sudo systemctl start meridian
-   ```
-6. Smoke from a LAN host:
+4. OAuth bootstrap — run `claude auth login --claudeai` **directly on the LXC** via the bundled binary. **Do not** scp `~/.claude/` from your Mac — macOS keeps the refresh token in the Keychain and the snapshot 401s as soon as the short-lived access token expires (incident write-up: 2026-05-17 → 2026-05-19, see [project_meridian](../homelab-docs/claude-memory/project_meridian.md)).
+   ```bash
+   # Stop the service so it's not racing the auth writer.
+   ssh cbalders@192.168.1.164 sudo systemctl stop meridian
+
+   # Paste-code flow as the meridian user (needs -t for TTY).
+   ssh -t cbalders@192.168.1.164 \
+     'sudo -u meridian -H /usr/lib/node_modules/@rynfar/meridian/node_modules/@anthropic-ai/claude-code/bin/claude.exe auth login --claudeai'
+   # → prints https://claude.com/cai/oauth/authorize?... — paste into a Mac
+   #   browser, log in with the Max account, paste the code back.
+   # → ends with: Login successful.
+
+   ssh cbalders@192.168.1.164 sudo systemctl start meridian
+
+   # Verify (expect loggedIn: true, subscriptionType: max):
+   ssh cbalders@192.168.1.164 \
+     'sudo -u meridian -H /usr/lib/node_modules/@rynfar/meridian/node_modules/@anthropic-ai/claude-code/bin/claude.exe auth status'
    ```
+5. Smoke from a LAN host:
+   ```bash
    curl http://192.168.1.164:3456/v1/messages \
      -H 'Content-Type: application/json' \
-     -H 'x-api-key: placeholder' \
      -H 'anthropic-version: 2023-06-01' \
-     -d '{"model":"claude-sonnet-4-5","max_tokens":100,"messages":[{"role":"user","content":"hi"}]}'
+     -d '{"model":"claude-haiku-4-5","max_tokens":40,"messages":[{"role":"user","content":"reply with the single word: pong"}]}'
    ```
 
 ## Operations