diff --git a/README.md b/README.md
index 61ce367..0df2054 100644
--- a/README.md
+++ b/README.md
@@ -49,6 +49,13 @@ cp .env.example .env
 | `GUILD_ID` | optional | Test server ID for instant command registration. If unset, commands register globally (can take up to an hour) |
 | `LAVALINK_URI` | optional | Defaults to `ws://localhost:2333` for local runs. In `docker-compose.yaml` the bot is pointed at `ws://lavalink:2333` (the service name) |
 | `LAVALINK_PASSWORD` | ✅ | Shared secret between the bot and the Lavalink server. Compose passes the same value to the server as `LAVALINK_SERVER_PASSWORD`, so they always match. The bot **exits** if it's unset |
+| `PLUGINS_YOUTUBE_OAUTH_REFRESHTOKEN` | optional | Read by the **Lavalink** container, not the bot. Skips the Google device flow on restart — see [YouTube tracks that need a login](#youtube-tracks-that-need-a-login) |
+| `CATCHPHRASES_FILE` | optional | Path to the catchphrase list `/play` quotes from. Defaults to `catchphrases.txt` in the working directory |
+| `ALWAYS_100_USERS_FILE` | optional | Path to the list of user IDs `/armeter` always rates 100%. Defaults to `always100.txt` |
+| `ALWAYS_90_USERS_FILE` | optional | Path to the list of user IDs `/armeter` always rates 90–100%. Defaults to `always90.txt` |
+
+All three text files take one entry per line; blank lines and `#` comments are
+ignored, and a missing file is not fatal (the bot just falls back to a default).
 
 `.env` is gitignored, so your token stays local.
 
@@ -150,8 +157,38 @@ Lavalink container, and the variable name maps onto
 Everything that already worked keeps using the anonymous clients — `TV` is last
 in the client list and only gets used when the others are refused.
 
+### Remote cipher
+
+YouTube serves some regions a localized player script the plugin can't parse,
+which fails playback with `must find sig function`. `lavalink/application.yaml`
+therefore hands the signature deciphering to a **remote cipher server**
+(`https://cipher.kikkia.dev`) instead of doing it locally. It's a third-party
+service and only sees the player script, no account data — drop the
+`remoteCipher` block if you'd rather not use it and playback works without it.
+
+## Deployment
+
+`.gitea/workflows/ci-cd.yaml` builds on every push to `main`/`dev`, and on `main`
+also pushes the bot image to the private registry and deploys over SSH. The
+deploy copies **only** `docker-compose.yaml` and `lavalink/application.yaml` to
+the server — `.env`, `catchphrases.txt`, `always100.txt` and `always90.txt` live
+on the server and are never overwritten — then runs `docker compose pull && up -d`
+followed by an explicit `restart lavalink` and `restart bot`. Both restarts are
+needed: a bind-mounted config change doesn't recreate a service on its own, and
+the bot has to reconnect afterwards or every `/play` fails with
+`Node main is unavailable`.
+
+Secrets used by the workflow: `DOMAIN`, `REGISTRY_USER`, `REGISTRY_PASSWORD`,
+`SSH_PRIVATE_KEY`, `DEPLOY_HOST`, `DEPLOY_USER`.
+
 ## Notes
 
 - Queue state is kept in memory, so it resets if the bot restarts.
 - YouTube occasionally breaks playback when Google changes its player. The fix is usually
   bumping the `youtube-plugin` version in `lavalink/application.yaml` and restarting the server.
+- That plugin is currently pinned to a **snapshot commit** (`snapshot: true`), not a
+  tagged release: the TV-client fixes playback depends on aren't in a release yet.
+  Move back to a version number once they are.
+- Lavalink downloads plugin jars into the `lavalink-plugins` named Docker volume. If a
+  plugin bump doesn't seem to take effect, `docker compose down -v` clears it — that also
+  drops the volume, so the next start re-downloads everything.