diff --git a/README.md b/README.md
index 0447114..cf2f28a 100644
--- a/README.md
+++ b/README.md
@@ -1,28 +1,74 @@
 # ib-gateway-docker
 
-This builds a Docker image with the latest version of [Interactive Brokers](https://interactivebrokers.com)' [IB Gateway](https://www.interactivebrokers.com/en/index.php?f=5041), the modern [IbcAlpha/IBC](https://github.com/IbcAlpha/IBC) for automation, and a VNC server for debugging purposes.
+A Docker image running [Interactive Brokers Gateway](https://www.interactivebrokers.com/en/index.php?f=5041) with [IbcAlpha/IBC](https://github.com/IbcAlpha/IBC) for headless automation and a VNC server for debugging.
 
-**Currently, the API is only enabled in read-only mode**, for testing purposes.
+## Quick Start
 
-## Building
+1. Copy and configure your credentials:
 
 ```sh
-make build
-make deploy
+cp .env.example .env
+# Edit .env with your IB paper trading credentials
 ```
 
-## Running
+2. Start the container:
 
 ```sh
-make run
+make up
+```
+
+This exposes:
+- **Port 4002** — TWS API for programmatic trading
+- **Port 5900** — VNC for debugging (password: `password`)
+
+3. Connect with [ib_insync](https://github.com/erdewit/ib_insync):
+
+```python
+from ib_insync import IB
+
+ib = IB()
+ib.connect('localhost', 4002, clientId=1)
+
+# Example: get Apple stock details
+aapl = Stock('AAPL', 'SMART', 'USD')
+ib.qualifyContracts(aapl)
+print(aapl)
+
+ib.disconnect()
 ```
 
-This will expose port 4002 for the TWS API (usable with, e.g., [ib_insync](https://github.com/erdewit/ib_insync)) and 5900 for VNC (with default password `1358`). **Neither are secure for public internet access**, as the expectation is that private, secure services will sit on top and be the only open interface to the internet.
+## Configuration
+
+Set these in your `.env` file:
+
+| Variable | Description |
+|----------|-------------|
+| `TWSUSERID` | IB account username |
+| `TWSPASSWORD` | IB account password |
+| `TRADING_MODE` | `paper` (default) or `live` |
+| `VNC_PASSWORD` | VNC server password |
 
-### VNC
+## Building & Releasing
+
+Build a new image:
 
 ```sh
-make vnc
+make build
 ```
 
-The password is `password`
+Create a versioned release (from `main` branch with a clean working tree):
+
+```sh
+make release
+```
+
+This tags the image as `v<TWS_VERSION>-ibc<IBC_VERSION>` and pushes it to Docker Hub via GitHub Actions.
+
+## Security
+
+⚠️ **This container is not secure for public internet access.**
+
+- Never commit `.env` — it is `.gitignore`d by default
+- Change the default VNC password (`password`) before exposing port 5900
+- Only run on trusted networks; place a secure reverse proxy or VPN in front if remote access is needed
+- Port 4002 (TWS API) and 5900 (VNC) have no built-in authentication beyond the VNC password