diff --git a/README.md b/README.md
index 0c28687..849b374 100644
--- a/README.md
+++ b/README.md
@@ -180,6 +180,19 @@ disables asyncpg's server-side prepared statements, which don't survive
 transaction-mode pooling), horizontally-scaled API and worker replicas. See
 [`docs/architecture.md`](docs/architecture.md).
 
+Requires an external Traefik instance already running with a
+`traefik-public` Docker network and a `letsencrypt` cert resolver
+configured (`docker-compose.prod.yml` attaches to it, it doesn't run
+Traefik itself). Aurora Core's production domain split is `api.amdbs.net`
+(this backend) / `www.amdbs.net` (frontend, separate project) — the
+production `.env` (never committed) needs, beyond the base vars in
+`.env.example`:
+
+```bash
+AURORA_API_HOST=api.amdbs.net       # Traefik router rule (docker-compose.prod.yml only, not read by the app)
+CORS_ORIGINS=https://www.amdbs.net  # must include the frontend's real origin
+```
+
 ## Known limitations
 
 See [`docs/database.md#known-limitations`](docs/database.md#known-limitations)