diff --git a/README.md b/README.md
index d67b2c5..e87f0f8 100644
--- a/README.md
+++ b/README.md
@@ -93,9 +93,6 @@ spec:
       volumeMounts:
         - name: mirror
           mountPath: /mirror
-        - name: docker-config
-          mountPath: /root/.docker
-          readOnly: true
   volumes:
     - name: docker-graph-storage
       emptyDir: {}
@@ -103,17 +100,29 @@ spec:
       configMap:
         name: base-images-mirror
         defaultMode: 0755
-    - name: docker-config
-      secret:
-        secretName: harbor-robot-dockerconfig
-        items:
-          - key: .dockerconfigjson
-            path: config.json
 EOF
+```
 
+**No `harbor-robot-dockerconfig` mount here on purpose** — that robot
+account is scoped only to the `homelab` project (push+pull there
+specifically); it has no grant on `base-images` at all, and making
+`base-images` public only grants anonymous *pull*, never push. Push
+always needs real credentials scoped to that project regardless. For a
+one-off manual task like this, simplest is just logging in with your
+Harbor admin account directly inside the pod, rather than provisioning
+a whole new robot account for something run this rarely:
+
+```
 kubectl wait --for=condition=Ready pod/base-images-mirror -n jenkins --timeout=120s
-kubectl exec -n jenkins base-images-mirror -c docker-cli -- sh -c '
+kubectl exec -it -n jenkins base-images-mirror -c docker-cli -- sh -c '
   for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 2; done
+  docker login harbor.192.168.1.7.nip.io
+'
+```
+(enter your Harbor admin username/password when prompted)
+
+```
+kubectl exec -n jenkins base-images-mirror -c docker-cli -- sh -c '
   cd /mirror && sh mirror.sh
 '
 kubectl delete pod base-images-mirror -n jenkins