diff --git a/README.md b/README.md
index 51d46ad..e54b0ab 100644
--- a/README.md
+++ b/README.md
@@ -887,22 +887,25 @@ the account you will log in as** (the `User` from step 3), narrowly authorized
 rather than bare:
 
 ```bash
-install -d -m 700 ~/.ssh
+mkdir -p ~/.ssh && chmod 700 ~/.ssh
 cat >> ~/.ssh/authorized_keys <<'KEY'
 from="192.168.1.0/24,192.168.4.0/24,10.8.0.7",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXAMPLE0000EXAMPLE0000EXAMPLE0000ex devbox-mymachine
 KEY
 chmod 600 ~/.ssh/authorized_keys
 ```
 
-Use `>>`, never `>` — one stray truncation revokes every other key on that
-account. The options prefix must sit on the **same physical line** as the key,
-comma-separated with no spaces: a paste that wrapped is the likeliest reason a
-key that looks right is refused. `ssh-copy-id` cannot add that prefix, so
-append by hand (or let it copy the bare key and edit the line afterwards). If
-authentication still fails with no clear reason, suspect permissions — sshd's
-`StrictModes` silently ignores `authorized_keys` when the home directory,
-`~/.ssh` or the file itself is group- or world-writable, and says why only in
-the peer's own log (`journalctl -u ssh`, `/var/log/auth.log`).
+Both lines are safe on a peer that is already set up: `mkdir -p` is a no-op
+when the directory exists, the `chmod`s only tighten, and appending never
+touches keys already listed. Use `>>`, never `>` — one stray truncation
+revokes every other key on that account. The options prefix must sit on the
+**same physical line** as the key, comma-separated with no spaces: a paste
+that wrapped is the likeliest reason a key that looks right is refused.
+`ssh-copy-id` cannot add that prefix, so append by hand (or let it copy the
+bare key and edit the line afterwards). If authentication still fails with no
+clear reason, suspect permissions — sshd's `StrictModes` silently ignores
+`authorized_keys` when the home directory, `~/.ssh` or the file itself is
+group- or world-writable, and says why only in the peer's own log
+(`journalctl -u ssh`, `/var/log/auth.log`).
 
 `restrict` disables pty, agent/X11 and port forwarding; append
 `port-forwarding` and `permitopen="127.0.0.1:<port>"` after it if you need one