diff --git a/configs/restic/ana-ml2/README.md b/configs/restic/ana-ml2/README.md
index a875f6d..e0f856f 100644
--- a/configs/restic/ana-ml2/README.md
+++ b/configs/restic/ana-ml2/README.md
@@ -35,36 +35,65 @@ where synapse/seafile/vaultwarden DB dumps run first.
 
 ## Deploy (one-time setup)
 
-### 1. Add the client entry to the Anaheim rest-server .htpasswd
+### 1. Credentials (repo already exists — reuse)
 
-On ana-docker (where rest-server-ana runs):
+The Anaheim rest-server already has an `ana-ml2` entry in its `.htpasswd`
+and a repo at `/ana-ml2/` from a prior pass. Reusing both keeps the
+snapshot history consolidated.
 
-```bash
-ssh -t ana-docker '
-  cd /opt/docker/data/rest-server-ana &&   # wherever the data dir is
-  sudo htpasswd -B /data/.htpasswd ana-ml2 &&   # prompts for a new password
-  docker restart rest-server
-'
-```
-
-Store the password where ana-ml2 can grab it. This is the **HTTP basic
-auth password**, not the restic repo passphrase — two separate secrets.
-
-### 2. Create the restic repo
-
-On ana-ml2, with a freshly generated encryption passphrase:
+On ana-ml2, install the two secret files from the existing values (both
+live in your password manager):
 
 ```bash
 ssh -t ana-ml2 '
   sudo install -d -o root -g root -m 0700 /etc/restic /var/lib/restic &&
-  echo "RESTIC_REPOSITORY=rest:http://ana-ml2:<htpasswd-password>@10.250.50.70:8000/ana-ml2/" | sudo tee /etc/restic/restic.env > /dev/null &&
+  sudo tee /etc/restic/restic.env > /dev/null <<EOF
+RESTIC_REPOSITORY=rest:http://ana-ml2:<EXISTING-HTPASSWD-PASSWORD>@10.250.50.70:8000/ana-ml2/
+EOF
   sudo chmod 600 /etc/restic/restic.env &&
 
-  # Generate a fresh passphrase (print it to stdout exactly once — store
-  # it in your password manager immediately; losing it = losing this
-  # host´s entire backup history).
-  openssl rand -base64 48 | sudo tee /etc/restic/password > /dev/null &&
-  sudo chmod 600 /etc/restic/password &&
+  sudo tee /etc/restic/password > /dev/null <<EOF
+<EXISTING-REPO-PASSPHRASE>
+EOF
+  sudo chmod 600 /etc/restic/password
+'
+```
+
+### 2. Verify creds against the existing repo
+
+Before deploying the profile, prove the secrets are correct:
+
+```bash
+ssh -t ana-ml2 '
+  sudo env $(cat /etc/restic/restic.env) \
+       RESTIC_PASSWORD_FILE=/etc/restic/password \
+       restic snapshots
+'
+```
+
+Expected: either a list of prior snapshots (from the earlier
+docker-files pass) or `no snapshots found` — both mean auth is good.
+If you see `Fatal: wrong password or no key found`, the passphrase in
+`/etc/restic/password` doesn't match the repo — check your password
+manager or rotate (see "Recreating the repo" below).
+
+**Do not run `restic init`** — the repo is already initialized; init
+against an existing repo errors out deliberately.
+
+### If no repo exists yet (fresh setup)
+
+Only applicable if you're starting from zero — otherwise skip.
+
+```bash
+ssh -t ana-docker '
+  sudo htpasswd -B /path/to/rest-server/data/.htpasswd ana-ml2 &&  # prompts for password
+  docker restart rest-server
+'
+
+ssh -t ana-ml2 '
+  # Write /etc/restic/restic.env and /etc/restic/password as above, using
+  # the fresh htpasswd password and a freshly generated passphrase:
+  openssl rand -base64 48  # save this in your password manager IMMEDIATELY
 
   sudo env $(cat /etc/restic/restic.env) \
        RESTIC_PASSWORD_FILE=/etc/restic/password \