diff --git a/README.md b/README.md
index 2bafac7..0878303 100644
--- a/README.md
+++ b/README.md
@@ -48,9 +48,14 @@ Releases are published on the [Releases](../../releases) page. Each release incl
 | `konduit-*-linux-x86_64` | Linux | CLI client |
 | `konduit-ctl-*-linux-x86_64` | Linux | Server provisioning tool |
 | `Konduit-*-x86_64.AppImage` | Linux | GUI client (AppImage) |
-| `konduit-cli-*-windows-x86_64.zip` | Windows | CLI client + wintun.dll |
-| `konduit-gui-*-windows-x86_64.zip` | Windows | GUI client |
-| `konduit-*-android.aab` | Android | Android app (sideload via bundletool) |
+| `konduit-gui-*-windows-x86_64-portable.zip` | Windows | GUI client |
+| `konduit-cli-*-windows-x86_64.zip` | Windows | CLI client + wintun.dll — **not in every release** |
+| `konduit-*-android.aab` | Android | Android app for bundletool sideload — **not in every release** |
+
+Which Windows and Android assets are attached varies between releases: v0.1.0-beta.9
+and v0.1.0-beta.10 carried both, v0.1.0-beta.11 shipped the Windows GUI zip only (as
+`-portable.zip`). **The [Releases](../../releases) page is authoritative** — check it
+rather than assuming a row is present. Android is on Google Play either way.
 
 ### Linux (CLI)
 
@@ -62,7 +67,15 @@ chmod +x konduit konduit-ctl
 echo "your secret mantra" | ./konduit-ctl bootstrap -l vpn.example.com:443 -p -
 
 # Connect a client
-./konduit connect --config client.toml
+./konduit --config client.toml
+```
+
+`--config`/`-c` is a top-level flag, not a `connect` flag. The `connect`
+subcommand takes the peer details individually instead:
+
+```bash
+./konduit connect --server vpn.example.com:443 \
+  --peer-id <peer-id> --identity <key-hex> --server-pub <server-pub-hex>
 ```
 
 ### Linux (GUI)
@@ -131,7 +144,7 @@ The VPN server and management UI are proprietary. Source review under NDA is ava
 
 **No UDP dependency:** Konduit does not require UDP at any layer.
 
-**Key storage:** Private keys are stored in the OS secure enclave on every platform (iOS Keychain, macOS Keychain, Android Keystore). They are never written to disk in plaintext.
+**Key handling:** Your private identity key is generated locally by `konduit-ctl` and written into the client configuration file you pass with `--config` — it is never transmitted to K-Ops, and K-Ops operates no server. **That file is the secret.** Treat it like a private key file: readable only by its owner, and the only thing standing between an attacker and a tunnel into your VPN is its permissions. Do not commit it or paste it into a bug report.
 
 ## Support