diff --git a/README.md b/README.md
index a8e21fb..235e3a9 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ The API service behind the platform. It handles accounts (sign-up, login, passwo
 
 The emulator runs in the visitor's browser, so gameplay has no server round-trip once a game has loaded. Every file goes through the Backend, which checks who may read or change it; nothing in storage is public.
 
-## Deployment
+## Running with Docker
 
 Each service has its own `Dockerfile` (`gb-emulator/` is built inside the Frontend image), and `compose.yml` at the root runs the whole platform:
 
@@ -85,7 +85,9 @@ The site is then at http://localhost:8080 (change with `WEB_PORT`). To build the
 docker compose --profile test run --rm emulator-tests
 ```
 
-In production, [`deploy/pixelpocket/values.yaml`](https://github.com/project-graphite/platform/blob/main/deploy/pixelpocket/values.yaml) in `platform` runs the same services from prebuilt images (`ghcr.io/project-graphite/pixelpocket/frontend` and `backend`), with resource limits and health checks. It carries its own copy of `infra/minio`, so change both together. Its secrets are in the organisation's secrets repository: `MONGO_PASSWORD`, `MINIO_ROOT_PASSWORD`, `S3_SECRET_KEY`, `JWT_SECRET`, `EMAIL_HOST` and `EMAIL_FROM`, plus the optional `EMAIL_PORT`, `EMAIL_USERNAME` and `EMAIL_PASSWORD`.
+In production, [`deploy/pixelpocket/values.yaml`](https://github.com/project-graphite/platform/blob/main/deploy/pixelpocket/values.yaml) in `platform` runs the same services from prebuilt images (`ghcr.io/project-graphite/pixelpocket/frontend` and `backend`), with resource limits and health checks. It carries its own copy of `infra/minio`, so change both together. Its secrets are in the organisation's secrets repository: `MONGO_PASSWORD`, `MINIO_ROOT_PASSWORD`, `S3_SECRET_KEY`, `JWT_SECRET`, `EMAIL_HOST` and `EMAIL_FROM`, plus the optional `EMAIL_PORT`, `EMAIL_USERNAME`, `EMAIL_PASSWORD`, `JWT_EXPIRES_IN` (default `90d`) and `JWT_COOKIE_EXPIRES_IN` (default `90`).
+
+To create the first admin in production, open the `backend` container's Terminal in the [Graphite Console](https://console.project-graphite.com), or `docker exec` into it on the VPS, and run `node scripts/createAdmin.js <email>`. It asks for the rest.
 
 ## License
 
diff --git a/backend/README.md b/backend/README.md
index f94af2e..f6cd3f0 100644
--- a/backend/README.md
+++ b/backend/README.md
@@ -37,7 +37,11 @@ Outside Docker, settings are read from `config.env` in this folder. In Docker, `
 | `JWT_EXPIRES_IN`        | Token lifetime, e.g. `90d`                           |
 | `JWT_COOKIE_EXPIRES_IN` | Cookie lifetime in days                              |
 | `FRONTEND_URL`          | Public site URL, used in password reset links        |
-| `EMAIL_HOST` and others | SMTP for password reset emails; without it, in development, emails are printed in the log |
+| `EMAIL_HOST`            | SMTP server for password reset emails; without it, in development, emails are printed in the log |
+| `EMAIL_PORT`            | SMTP port (default 587)                              |
+| `EMAIL_USERNAME`        | SMTP user; used only together with `EMAIL_PASSWORD`  |
+| `EMAIL_PASSWORD`        | SMTP password                                        |
+| `EMAIL_FROM`            | Sender address (default `PixelPocket <noreply@pixelpocket.local>`) |
 | `S3_ENDPOINT`           | Object storage URL, e.g. `http://minio:9000`; any S3-compatible store works |
 | `S3_BUCKET`             | Bucket name (default `pixelpocket`)                  |
 | `S3_ACCESS_KEY`         | Storage account with access to that bucket only      |