diff --git a/ansible/README.md b/ansible/README.md
index 13bbb0d..6897b98 100644
--- a/ansible/README.md
+++ b/ansible/README.md
@@ -40,12 +40,15 @@ console, not SSH:
 
 ```bash
 cp inventory.example.yml inventory.yml
-ansible-playbook bootstrap.yml            # root already has your key
-ansible-playbook bootstrap.yml -k         # root password login (needs sshpass)
+ansible-playbook bootstrap.yml
 # custom key or username:
 ansible-playbook bootstrap.yml -e bootstrap_ssh_public_key_file=~/.ssh/vpnhub.pub
 ```
 
+It prompts for the root SSH password up front (install `sshpass` on the
+control node for password auth). If root already logs in with your key,
+just press Enter at the prompt.
+
 Everything after this runs as `ansible` (already the inventory example's
 default).
 
diff --git a/docs/SITE-SIDE.md b/docs/SITE-SIDE.md
index db46114..329d0c9 100644
--- a/docs/SITE-SIDE.md
+++ b/docs/SITE-SIDE.md
@@ -68,9 +68,13 @@ manually issued). Export the issuing CA chain as PEM →
 
 ## 6. Duo Admin Panel
 
-Applications → Protect an Application → **OpenVPN** (RADIUS). Copy the
-integration key, secret key, and API hostname into `.env`. Recommended
-policy: enrolled users only; new-user policy deny.
+Applications → Protect an Application → search **RADIUS** → Protect.
+(Not the "OpenVPN" catalog entry — that one is for Duo's server-side
+plugin, not the Auth Proxy `radius_server_auto` flow we use.) Copy the
+integration key, secret key, and API hostname into `.env` /
+`group_vars/vpnhub.yml`. Set username normalization to **Simple** so
+`user`, `DOMAIN\user`, and `user@domain` all map to one Duo user.
+Recommended policy: new-user policy deny (enrolled users only).
 
 ## 7. Public DNS