diff --git a/configs/restic/ana-ml2/README.md b/configs/restic/ana-ml2/README.md
index e0f856f..15fe275 100644
--- a/configs/restic/ana-ml2/README.md
+++ b/configs/restic/ana-ml2/README.md
@@ -61,13 +61,20 @@ EOF
 
 ### 2. Verify creds against the existing repo
 
-Before deploying the profile, prove the secrets are correct:
+Before deploying the profile, prove the secrets are correct. The
+`/etc/restic/restic.env` and `/etc/restic/password` files are root:600,
+so the env-file read AND the restic invocation both need to run inside
+the same sudo shell — otherwise `$(cat …)` runs as the login user,
+fails silently, and restic complains about a missing repository:
 
 ```bash
 ssh -t ana-ml2 '
-  sudo env $(cat /etc/restic/restic.env) \
-       RESTIC_PASSWORD_FILE=/etc/restic/password \
-       restic snapshots
+  sudo bash -c "
+    set -a
+    . /etc/restic/restic.env
+    set +a
+    RESTIC_PASSWORD_FILE=/etc/restic/password restic snapshots
+  "
 '
 ```