diff --git a/README.md b/README.md
index 23d0544..44942b7 100644
--- a/README.md
+++ b/README.md
@@ -44,15 +44,33 @@ That's it. The script installs everything and starts NextNVR automatically.
 | 💾 **Storage** | Flat per-camera directories, 7-day retention, auto-cleanup |
 | 🖥️ **Live Wall** | 4×2 grid with auto-refreshing snapshots. Click for full live stream |
 | 🔍 **Playback** | Browse recordings by camera and date with snapshot thumbnails |
-| ⚙️ **Setup Wizard** | ONVIF auto-discovery scans your network and pre-fills camera details |
+| ⚙️ **Setup Wizard** | ONVIF auto-discovery + admin password setup on first run |
+| 🔐 **Two-Port Auth** | `:8080` with master login, `:8090` open viewer for LAN guests |
 | 🔒 **100% Local** | Everything runs on your hardware. No cloud, no subscriptions, no telemetry |
 
 ---
 
+## Authentication
+
+NextNVR runs two HTTP servers:
+
+| Port | Audience | Auth | Access |
+|---|---|---|---|
+| `8080` | You (admin) | Master login | Live Wall, Playback, Settings |
+| `8090` | Guests / LAN | None | Live Wall only |
+
+**First run**: the setup wizard prompts you to set a master username and password. Until you do, both ports are open. Once saved, port 8080 requires login. Port 8090 stays open — ideal for a QR code at a guesthouse: "Watch what we watch."
+
+**Viewer port 8090** can be disabled by setting `viewer.enabled: false` in `config.yaml`.
+
+To reset the master password, edit `/opt/nextnvr/config.yaml` and set `auth.enabled: false`, then restart.
+
+---
+
 ## Remote Access (Optional)
 
 1. **Dynamic DNS** — use DuckDNS, No-IP, or Cloudflare for a domain name
-2. **Port forwarding** — forward port `8080` to the NextNVR server
+2. **Port forwarding** — forward port `8080` to the NextNVR server (and `8090` if you want LAN guests to have open access)
 3. For production, put NextNVR behind a reverse proxy (Zoraxy, Nginx) with HTTPS
 
 ---
@@ -75,7 +93,6 @@ That's it. The script installs everything and starts NextNVR automatically.
 - ❌ Cloud connectivity of any kind
 - ❌ AI/ML object detection (use your camera's built-in detection)
 - ❌ Mobile apps (the web UI is responsive and PWA-ready)
-- ❌ User authentication (put it behind a reverse proxy)
 
 ---