diff --git a/ks4/README.md b/ks4/README.md
index 8a57ad0..e5169e6 100644
--- a/ks4/README.md
+++ b/ks4/README.md
@@ -6,7 +6,8 @@ Incus host at OVH — public-facing self-hosted services.
   ZFS pool `data` on `sda5`) — setup & rebuild:
   [install.md](install.md)
 - SSH: `ssh -i id_rsa_claude -p 2233 julien@193.70.35.17`
-  (`julien` has passwordless `sudo incus …`)
+  (`julien` has passwordless `sudo incus …`, including
+  `sudo incus exec …`; the backup crons themselves run as root)
 - Instances are on a NAT bridge `incusbr0` (192.168.1.0/24); public
   ingress via Incus proxy devices. `gateway` (nginx) is the sole HTTP/S
   entry point and fans out to the app containers.