diff --git a/README.md b/README.md
index 766a4bb..51d46ad 100644
--- a/README.md
+++ b/README.md
@@ -882,12 +882,28 @@ cat ~/.ssh-local/mypeer_devbox_ed25519.pub
 # ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXAMPLE0000EXAMPLE0000EXAMPLE0000ex devbox-0d11ec7731c7
 ```
 
-**2. On the peer** — authorize it narrowly rather than bare:
+**2. On the peer** — append that public key to `~/.ssh/authorized_keys` **of
+the account you will log in as** (the `User` from step 3), narrowly authorized
+rather than bare:
 
-```
+```bash
+install -d -m 700 ~/.ssh
+cat >> ~/.ssh/authorized_keys <<'KEY'
 from="192.168.1.0/24,192.168.4.0/24,10.8.0.7",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXAMPLE0000EXAMPLE0000EXAMPLE0000ex devbox-mymachine
+KEY
+chmod 600 ~/.ssh/authorized_keys
 ```
 
+Use `>>`, never `>` — one stray truncation revokes every other key on that
+account. The options prefix must sit on the **same physical line** as the key,
+comma-separated with no spaces: a paste that wrapped is the likeliest reason a
+key that looks right is refused. `ssh-copy-id` cannot add that prefix, so
+append by hand (or let it copy the bare key and edit the line afterwards). If
+authentication still fails with no clear reason, suspect permissions — sshd's
+`StrictModes` silently ignores `authorized_keys` when the home directory,
+`~/.ssh` or the file itself is group- or world-writable, and says why only in
+the peer's own log (`journalctl -u ssh`, `/var/log/auth.log`).
+
 `restrict` disables pty, agent/X11 and port forwarding; append
 `port-forwarding` and `permitopen="127.0.0.1:<port>"` after it if you need one
 specific tunnel. `from=` must list the **host's** addresses, not the