diff --git a/README.md b/README.md
index 45a90d7..a6d8996 100644
--- a/README.md
+++ b/README.md
@@ -38,8 +38,8 @@ The worker image pulls anonymously — no `docker login` required.
 **Expected log lines on a healthy start:**
 `authenticated to PocketBase …` — that's it. (The agent's location is
 carried by its central record; nothing local participates.)
-A rejected password or unknown location name is FATAL by design —
-check the values in `.env` and `docker compose -f docker-compose.agent.yml up -d --force-recreate`.
+A rejected password is FATAL by design — check `AGENT_IDENTITY` /
+`AGENT_PASSWORD` in `.env` and `docker compose -f docker-compose.agent.yml up -d --force-recreate`.
 
 **Verify centrally:** Sam confirms the agent flips **online** on the
 central `/agents` page within ~90 s, then queues a pinned test scan against