diff --git a/deploy/README.md b/deploy/README.md
index cd7f264..4faf110 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -168,6 +168,9 @@ mkdir -p ~/opencode-devbox && cd ~/opencode-devbox
 curl -sL https://gitea.jordbo.se/joakimp/opencode-devbox/raw/branch/main/docker-compose.yml -o docker-compose.yml
 curl -sL https://gitea.jordbo.se/joakimp/opencode-devbox/raw/branch/main/.env.example -o .env
 vim .env                                           # configure provider and keys
+vim docker-compose.yml                             # uncomment optional volume mounts
 docker compose up -d
 docker compose exec -u developer devbox opencode
 ```
+
+> **AWS Bedrock users:** Uncomment the `~/.aws` volume mount in `docker-compose.yml` before starting. You'll also need to copy your `~/.aws/config` from a machine where SSO is already configured, then authenticate inside the container with `aws sso login`.
diff --git a/deploy/cloud-init.yml b/deploy/cloud-init.yml
index f03fff6..bc7a971 100644
--- a/deploy/cloud-init.yml
+++ b/deploy/cloud-init.yml
@@ -100,7 +100,8 @@ final_message: |
        curl -sL https://gitea.jordbo.se/joakimp/opencode-devbox/raw/branch/main/docker-compose.yml -o docker-compose.yml
        curl -sL https://gitea.jordbo.se/joakimp/opencode-devbox/raw/branch/main/.env.example -o .env
     3. Edit .env with your provider and keys
-    4. docker compose up -d
-    5. docker compose exec -u developer devbox opencode
+    4. Edit docker-compose.yml to uncomment optional mounts (e.g. ~/.aws for Bedrock)
+    5. docker compose up -d
+    6. docker compose exec -u developer devbox opencode
 
   Cloud-init run completed in $UPTIME seconds.