diff --git a/README.md b/README.md
index 89bd819..57cbc03 100644
--- a/README.md
+++ b/README.md
@@ -64,6 +64,25 @@ on the first call.
 - Still on 0.15? The last release that runs on it is tagged [`stalwart-0.15-support`](https://github.com/LINUXexpert-org/ihasmail/releases/tag/stalwart-0.15-support).
 - Upgrading? [stalwart-migrator](https://github.com/LINUXexpert-org/stalwart-migrator) does it in place, checkpointing every phase and validating afterwards. The live instance moved 0.15.5 → 0.16.19 with eight seconds of downtime and nothing lost.
 
+## Quick start (Docker)
+
+```bash
+cp .env.example .env
+# edit: STALWART_URL=https://mail.example.com  and  APP_SECRET=$(openssl rand -base64 48)
+docker compose up --build -d
+# → http://localhost:8080  (put Caddy/nginx in front for TLS; see Caddyfile.example / nginx.example.conf)
+```
+
+Users sign in with their Stalwart mailbox credentials. **An account with
+two-factor authentication needs an app password**, created in Stalwart's own
+settings — Stalwart accepts a TOTP code only through an OAuth flow and offers no
+password grant, so no client holding a username and password can exchange them
+plus a code for a token.
+
+Full instructions, TLS, and every environment variable:
+[Installing](https://docs.ihasmail.org/install/) ·
+[Configuring](https://docs.ihasmail.org/configure/).
+
 ## Architecture
 
 ```
diff --git a/ROADMAP.md b/ROADMAP.md
index cd53cc0..68a2758 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -8,4 +8,4 @@ See [KNOWN-ISSUES.md](KNOWN-ISSUES.md) for what is built but worth knowing about
 
 - Snooze (nothing in JMAP or Stalwart supports it, and ihasmail never stores a password, so nothing could act on a mailbox while you are away)
 - Translations (strings are English-only for now)
-- **Two-factor sign-in.** Today an account with 2FA must use an app password (see [Installing](https://docs.ihasmail.org/install/#checking-it-came-up)), and Settings › Security offers no way to switch 2FA *on* — only off, for an account that already has it. Supporting a TOTP code directly means implementing OAuth: Stalwart offers the authorization-code and device flows and no password grant, so ihasmail would hand sign-in to Stalwart's own login and come back with a token. That is a better security posture than the sealed password it holds now — a refresh token rather than a credential — but it replaces ihasmail's own sign-in page for those users and may need an OAuth client registered. Reported as [#75](https://github.com/LINUXexpert-org/ihasmail/issues/75)
+- **Two-factor sign-in.** Today an account with 2FA must use an app password (see [Quick start](README.md#quick-start-docker)), and Settings › Security offers no way to switch 2FA *on* — only off, for an account that already has it. Supporting a TOTP code directly means implementing OAuth: Stalwart offers the authorization-code and device flows and no password grant, so ihasmail would hand sign-in to Stalwart's own login and come back with a token. That is a better security posture than the sealed password it holds now — a refresh token rather than a credential — but it replaces ihasmail's own sign-in page for those users and may need an OAuth client registered. Reported as [#75](https://github.com/LINUXexpert-org/ihasmail/issues/75)