diff --git a/README.md b/README.md
index 41adc0c..91edb94 100644
--- a/README.md
+++ b/README.md
@@ -10,10 +10,23 @@ Lightweight dashboard for DietPi-based Pi-Kit images.
 - Frontend: `cd pikit-web && npm install` (once), `npm run dev` for live reload, `npm test` for Playwright, `npm run build` for production `dist/`.
 - API: `python pikit-api.py` runs the same routes locally (no auth) as on-device.
 
+## Build, package, and publish a release
+1) Bump `pikit-web/data/version.json` to the target version (e.g., `0.1.3-dev1`), then `cd pikit-web && npm run build`.
+2) Package: `./tools/release/make-release.sh <version> https://git.44r0n.cc/44r0n7/pi-kit/releases/download/v<version>`  
+   Outputs in `out/releases/`: `pikit-<version>.tar.gz` and `manifest.json` (with SHA256 + changelog URL).
+3) Create a Gitea release/tag `v<version>` and upload:
+   - `pikit-<version>.tar.gz`
+   - `manifest.json`
+   - `CHANGELOG-<version>.txt` (add a short changelog in `out/releases/`)
+4) Update repo manifests (public raw defaults used by devices): edit `manifests/manifest-stable.json` and `manifests/manifest-dev.json` with `version`, `bundle`, `changelog`, `_release_date`, `sha256` from the new bundle, then commit/push.
+   - Default OTA URLs (no token needed):  
+     - Stable: `https://git.44r0n.cc/44r0n7/pi-kit/raw/branch/main/manifests/manifest-stable.json`  
+     - Dev: `https://git.44r0n.cc/44r0n7/pi-kit/raw/branch/main/manifests/manifest-dev.json`
+
 ## Deploy to a Pi-Kit box
 1) Copy `pikit-api.py` **and** the `pikit_api/` directory to the device (e.g., `/usr/local/bin/`) and restart `pikit-api.service`.
 2) Sync `pikit-web/dist/` (preferred) to `/var/www/pikit-web/`, then restart `dietpi-dashboard-frontend.service`.
-3) Using release bundles: `./tools/release/make-release.sh <version> <base_url>`, upload the tarball + manifest, and point `PIKIT_MANIFEST_URL` (systemd drop-in) to that manifest URL for OTA.
+3) OTA defaults (no per-device token required): `PIKIT_MANIFEST_URL` points to the stable manifest above; enabling “Allow dev builds” in the UI makes the updater consult the dev manifest URL. Override via systemd drop-in if you need to pin to a specific manifest.
 
 ## Notes
 - Service paths are normalized (leading slash) and URLs include optional subpaths.