diff --git a/README.md b/README.md
index 7c277b6..9bd420b 100644
--- a/README.md
+++ b/README.md
@@ -84,6 +84,48 @@ an installer, partitions via disko, installs.
 Manual alternative (USB ISO): boot installer, `disko` the disk, then
 `nixos-install --flake .#jupiter`.
 
+## First install on terra — in-place kexec (replacing CachyOS)
+
+terra is the desktop you're typing on, currently running CachyOS with a
+writable root — no ZimaOS-style read-only-root problem, no second machine
+needed. Everything is already prepped in this repo: real OS-disk id in
+`disk-config.nix`, real login pubkey in `common.nix`, terra's age recipient in
+`.sops.yaml`, its host key pre-generated at `~/.config/homelab/terra/`, and
+`secrets/terra.yaml` already holds real `darman_password` / `tailscale_authkey`
+values. Nothing to fill in — just run it.
+
+> ⚠️  The OS disk (`ata-KINGSTON_SA400S37480G_50026B738072F6C6`) is WIPED. The
+> dev-data disks (`/mnt/hdd_01` ext4, `/mnt/ssd_01` LVM) and the leftover ntfs
+> disks are not in disko and are untouched — but double check with
+> `lsblk -o NAME,SERIAL,SIZE,MODEL` before proceeding if the box's disks have
+> changed since `disk-config.nix` was written.
+
+1. From a root shell on terra itself:
+   ```
+   sudo ./scripts/deploy kexec-local --yes
+   ```
+   Stages a RAM installer and kexecs into it. The console drops for ~1-2 min
+   then comes back logged in as `nixos-installer` — same ssh host key, so
+   `known_hosts` still matches if you're watching over ssh instead of the
+   physical console.
+2. Still targeting terra (now `localhost`/`127.0.0.1` from the installer's own
+   shell):
+   ```
+   ./scripts/deploy install terra localhost
+   ```
+   `localhost`/`127.0.0.1` skips nixos-anywhere/ssh and runs disko + `nixos-install`
+   directly against `/mnt`. Ships terra's pre-generated host key so
+   `/run/secrets/*` decrypts on boot #1.
+3. Reboot into NixOS. Then, same as any other host:
+   ```
+   ssh darman@terra sudo -v          # DO NOT SKIP — see below
+   ```
+
+`darman` is created with `mutableUsers = true`, so `/etc/shadow` is written
+**once**. If the sops secret wasn't readable at that moment the account gets
+`!` (locked) permanently and no `deploy switch` will fix it — verify sudo
+works while you still have physical console access as a fallback.
+
 ## Deploy (the `./deploy` wrapper)
 
 All arguments mandatory — no default host, no default config.