diff --git a/README.md b/README.md
index 74e0aac..b7c8b31 100644
--- a/README.md
+++ b/README.md
@@ -168,6 +168,13 @@ Create an account:
 pdsadmin account create
 ```
 
+Enroll an operator (admin dashboard) passkey — prints a single-use link, expires in 15 minutes; open it on the operator hostname over HTTPS (passkeys are per-hostname and need a secure context). Rerun to enroll another device or recover after losing all passkeys:
+
+```bash
+cd /pds/operator
+sudo docker compose exec app node dist/cli.js enroll
+```
+
 ## Teardown
 
 Run on the server to remove everything, use with caution: