diff --git a/README.md b/README.md
index 1d5173d..98f0069 100644
--- a/README.md
+++ b/README.md
@@ -30,12 +30,14 @@ docker compose up -d
 # proxy :80/:443 published; admin binds 127.0.0.1:81 (not published by default)
 # or
 docker build -t helix-proxy:dev .
-docker run -p 80:80 -p 443:443 \
+docker run --env ADMIN_PASSWORD='choose-a-real-password' \
+  -p 80:80 -p 443:443 \
   -e ADMIN_PORT=81 -e PROXY_HTTP_PORT=80 -e PROXY_HTTPS_PORT=443 \
   -v $PWD/data:/app/data --workdir /app helix-proxy:dev
 ```
 
 Publishing admin (`-p 81:81`) also needs `-e ADMIN_HOST=0.0.0.0`. Do not publish :81 on untrusted networks.
+Without those env overrides the binary still defaults to admin `127.0.0.1:8081` and proxy `:8080` / `:18443` inside the container.
 
 PUID/PGID + DISABLE_IPV6 example (see docker-compose.yml for full):
 ```yaml