diff --git a/DEPLOY.md b/DEPLOY.md
index 5ccbe70..e1111e5 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -33,11 +33,17 @@ Grant the app DB user `SELECT` on `ladilldb.platform_settings` only.
 
 ```bash
 sudo install -d -o deploy -g www-data /var/www/ladill-mini
+sudo install -d -o deploy -g www-data /var/www/ladill-mini/{releases,shared}
 sudo mysql -e "CREATE DATABASE ladill_mini CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
 sudo mysql -e "CREATE USER 'ladill_mini'@'127.0.0.1' IDENTIFIED BY '<pw>';"
 sudo mysql -e "GRANT ALL ON ladill_mini.* TO 'ladill_mini'@'127.0.0.1'; FLUSH PRIVILEGES;"
+sudo mysql -e "GRANT SELECT ON ladilldb.platform_settings TO 'ladill_mini'@'127.0.0.1'; FLUSH PRIVILEGES;"
 ```
 
+The Gitea deploy runner acts as `deploy`. The app root and `current` symlink must be
+owned by `deploy` (not root), or the release switch step will fail with
+`sudo: a password is required`.
+
 ## 3. Register OIDC client (platform)
 
 ```bash