diff --git a/access/README.md b/access/README.md
index fba8414..4f92e25 100644
--- a/access/README.md
+++ b/access/README.md
@@ -1,5 +1,11 @@
 # Forge access — read this first
 
+## Which channel actually works for you
+
+**HTTPS + token.** SSH is verified working from the server side, but Zeph's gateway resets SSH
+(`kex_exchange_identification: read: Connection reset by peer` via 198.19.0.1:3128), so for him the operational
+path is HTTPS with the token in this envelope. SSH remains available to anyone whose network does not proxy it.
+
 ## Your token, in an envelope only you can open
 
 `zephyrus-forge-token.age` is your Gitea personal access token, encrypted to the SSH key you registered
@@ -9,7 +15,7 @@ useless without your private key.
 Decrypt it yourself:
 
 ```bash
-age -d -i ~/.ssh/id_ed25519 access/zephyrus-forge-token.age
+age -d -i ~/.ssh/<the-key-whose-public-half-is-registered> access/zephyrus-forge-token.age
 ```
 
 Store the value in your secure credential store and **do not commit it anywhere** — it is not in this repo in