diff --git a/README.md b/README.md
index 95562bc..e03ebaf 100644
--- a/README.md
+++ b/README.md
@@ -63,9 +63,17 @@ pct set 103 -mp0 /mnt/nfs/restic,mp=/mnt/restic
 
 ## Restic Clients
 
+Set up provisioner password by running this and pasting in the current JWK provisioner password for `admin`
+
+```
+read -s secret && (umask 077; echo "$secret" > secret.txt)
+```
+
 ```
 cd $(step path)/certs && \
-step ca certificate --provisioner admin $USER@$HOSTNAME restic.crt restic.key && \
+step ca certificate \
+    --provisioner admin --password-file secret.txt \
+    $(hostnamectl hostname) restic.crt restic.key && \
 (umask 077; cat restic.crt restic.key > restic.pem)
 ```