diff --git a/configs/restic/vm-esh-nas/README.md b/configs/restic/vm-esh-nas/README.md
index 3ba7e37..d92e48e 100644
--- a/configs/restic/vm-esh-nas/README.md
+++ b/configs/restic/vm-esh-nas/README.md
@@ -49,18 +49,24 @@ ssh -t vm-esh-nas 'sudo apt update && sudo apt install -y restic'
 If not already present from an earlier pass:
 
 ```bash
-# Single ssh invocation — the pipe must stay on the REMOTE side so
-# sudo can prompt on the local keyboard. `ssh -t ... | ssh -t ...`
-# breaks because sudo's password read conflicts with the pipe contents.
-ssh -t ana-docker '
+# The repo dir is on NFS from the Debian NAS (10.250.50.50) exported with
+# root_squash, so sudo gets denied writes. It is owned by lkraven:lkraven,
+# so append as lkraven directly — no sudo needed.
+ssh ana-docker '
   docker run --rm httpd:2.4-alpine htpasswd -nbB vm-esh-nas "<PW>" \
-    | sudo tee -a /mnt/backup/restic/repo/ana/.htpasswd >/dev/null
+    >> /mnt/backup/restic/repo/ana/.htpasswd
 '
 ```
 
 Heads-up: the password is in your shell history after this runs.
 Scrub with `history -d <line>` or `history -c`.
 
+Sanity check the file ownership afterward:
+```bash
+ssh ana-docker 'ls -la /mnt/backup/restic/repo/ana/.htpasswd'
+# expect: -rw------- 1 lkraven lkraven ...
+```
+
 ### 3. Install restic creds on vm-esh-nas
 
 ```bash