diff --git a/PATCHES.md b/PATCHES.md
index 77ec605..7c00947 100644
--- a/PATCHES.md
+++ b/PATCHES.md
@@ -82,8 +82,9 @@ Patches #8+ live in `vminitd/` (the guest agent), which rides in the initfs OCI
 until that image is rebuilt from this source and published, and `ContainerEngine.vminitReference`
 points at it. Build it with **`make vminit-image`** (root Makefile) — it builds cctl + the guest
 vminitd/vmexec from this vendored tree and packages `ghcr.io/abkslm/vminit:<tag>` into the local cctl
-store; `make vminit-image-push` (with GHCR creds in the environment) publishes it, and `vminitReference`
-is pinned to that custom image. First time on a machine, run `make vminit-image-prep` once (installs
+store; `make vminit-image-push` publishes it (authenticate once with `make vminit-image-login`, which
+stores a GHCR token in the macOS Keychain — or set `REGISTRY_HOST`/`USERNAME`/`TOKEN`), and
+`vminitReference` is pinned to that custom image. First time on a machine, run `make vminit-image-prep` once (installs
 the swiftly toolchain + musl SDK the guest cross-build needs). Bump the `-nucleicN` tag suffix and
 rebuild whenever a guest patch changes. Built locally, not in CI: the host framework needs the macOS
 26+ Virtualization SDK that GitHub-hosted runners lack.