diff --git a/configs/restic/vm-esh-nas/README.md b/configs/restic/vm-esh-nas/README.md
index 41e3bd6..3ba7e37 100644
--- a/configs/restic/vm-esh-nas/README.md
+++ b/configs/restic/vm-esh-nas/README.md
@@ -49,11 +49,18 @@ ssh -t vm-esh-nas 'sudo apt update && sudo apt install -y restic'
 If not already present from an earlier pass:
 
 ```bash
-# Generate the bcrypt line locally (httpd:2.4-alpine throwaway container)
-ssh ana-docker 'docker run --rm httpd:2.4-alpine htpasswd -nbB vm-esh-nas "<PW>"' \
-  | ssh -t ana-docker 'sudo tee -a /mnt/backup/restic/repo/ana/.htpasswd >/dev/null'
+# Single ssh invocation — the pipe must stay on the REMOTE side so
+# sudo can prompt on the local keyboard. `ssh -t ... | ssh -t ...`
+# breaks because sudo's password read conflicts with the pipe contents.
+ssh -t ana-docker '
+  docker run --rm httpd:2.4-alpine htpasswd -nbB vm-esh-nas "<PW>" \
+    | sudo tee -a /mnt/backup/restic/repo/ana/.htpasswd >/dev/null
+'
 ```
 
+Heads-up: the password is in your shell history after this runs.
+Scrub with `history -d <line>` or `history -c`.
+
 ### 3. Install restic creds on vm-esh-nas
 
 ```bash