diff --git a/README.md b/README.md
index 8505c0a..8b26da8 100644
--- a/README.md
+++ b/README.md
@@ -9,10 +9,18 @@ collections:
   - src: git+https://guardianproject.dev/sr2/ansible-collection-core.git
     version: "main"
 roles:
-  - src: git+https://github.com/ansible-lockdown/RHEL9-CIS.git
-    version: "2.0.3"
+  - src: git+https://guardianproject.dev/sr2/RHEL9-CIS.git
+    version: "2.0.3-become"
 ```
 
+## Convention
+
+We assume that these roles will be run initially as root, and then as an unprivileged user after initial bootstrap.
+Some hardening may only be performed in the second run when we can see that the unprivileged user access is configured
+and root access is no longer required.
+If anything fails due to permissions when running as an unprivileged user, please report that in our
+[issue tracker](https://guardianproject.dev/sr2/ansible-collection-core/issues).
+
 ## Licence
 
 Copyright © SR2 Communications Limited 2021-2025.