diff --git a/platform-infra/ansible/README.md b/platform-infra/ansible/README.md
index 1b96c2b..19812dc 100644
--- a/platform-infra/ansible/README.md
+++ b/platform-infra/ansible/README.md
@@ -35,12 +35,15 @@ Key variables in `group_vars/all.yml`:
 ## Run
 
 ```bash
-ansible-playbook site.yml --check     # dry run (note: first run can't fully
-                                      # check tasks that depend on ZFS/Docker
-                                      # not yet present)
-ansible-playbook site.yml             # apply
+ansible-playbook site.yml --syntax-check   # no-host pre-flight
+ansible-playbook site.yml -K               # apply (-K prompts for the sudo/become
+                                           # password; omit only if the user has
+                                           # passwordless sudo on the VM)
 ```
 
+Everything runs via `become` (root), so `-K` is required unless the target user
+has passwordless sudo (`/etc/sudoers.d/…  NOPASSWD:ALL`).
+
 Run a single layer with tags: `--tags zfs`, `--tags docker`, `--tags firewall`,
 `--tags ssh`, `--tags base`.