diff --git a/POSTINSTALL.md b/POSTINSTALL.md
index 6d7c362..57e2d67 100644
--- a/POSTINSTALL.md
+++ b/POSTINSTALL.md
@@ -23,13 +23,25 @@ The installer now asks for dedicated hostnames for the Auth/Accounts/Cast/Albums
 
 ## Administration
 
-- Use the bundled CLI from the Cloudron web terminal (CLI state lives in `/app/data/cli-data`):
+- Use the bundled CLI from the Cloudron web terminal (CLI state lives in `/app/data/cli-data`). On a new deployment initialise it once:
   ```bash
-  ente --help
+  # from the Cloudron terminal, logged in as root
+  cat <<'EOF' >/cli-data/config.yaml
+endpoint:
+  api: https://<your-app-domain>/api
+log:
+  http: false
+EOF
+  mkdir -p /cli-data/export
+  chown cloudron:cloudron /cli-data /cli-data/config.yaml /cli-data/export
 
-  # List users (requires an existing admin account)
-  ente admin list-users --admin-user admin@example.com
+  # store your account (enter the OTP emailed to you)
+  sudo -u cloudron ente account add
+
+  # inspect available commands
+  sudo -u cloudron ente --help
   ```
+  Once the account is added you can follow the upstream admin docs for tasks like whitelisting and quota adjustments.
   See the upstream admin guides for further context: [user administration](https://ente.io/help/self-hosting/administration/users) and [CLI reference](https://ente.io/help/self-hosting/administration/cli).
 
 - To persist custom Museum settings (for example, seeding super-admin email addresses), create `/app/data/config/museum.override.yaml`. The file is appended to `museum/configurations/local.yaml` on each startup.
diff --git a/README.md b/README.md
index 5bbd620..1478f78 100644
--- a/README.md
+++ b/README.md
@@ -64,7 +64,22 @@ After installing on Cloudron remember to:
      super-admins:
        - admin@example.com
    ```
-4. Use the bundled Ente CLI for admin tasks via `cloudron exec --app <location> -- sudo -u cloudron ente --help`. The CLI stores its state in `/app/data/cli-data` (exposed inside the container at `/cli-data`) and already trusts your app’s API endpoint. Typical workflow:
+4. Use the bundled Ente CLI for admin tasks via `cloudron exec --app <location> -- sudo -u cloudron ente --help`. On a fresh install run the following once (this initialises the CLI’s container-specific config and keystore):
+   ```bash
+   cloudron exec --app ente.cloudron.io -- bash -lc \
+     'cat <<EOF >/cli-data/config.yaml
+endpoint:
+  api: https://ente.cloudron.io/api
+log:
+  http: false
+EOF
+mkdir -p /cli-data/export
+chown cloudron:cloudron /cli-data /cli-data/config.yaml /cli-data/export'
+
+   # add your account (respond to prompts with the OTP sent to your email)
+   cloudron exec --app ente.cloudron.io -- sudo -u cloudron ente account add
+   ```
+   Afterwards the usual admin commands work as documented. Example:
    ```bash
    cloudron exec --app ente.cloudron.io -- sudo -u cloudron ente admin list-users --admin-user admin@example.com
    ```