diff --git a/docs/socks-modes.md b/docs/socks-modes.md
index 53f266e..ee7e6cd 100644
--- a/docs/socks-modes.md
+++ b/docs/socks-modes.md
@@ -14,12 +14,19 @@ server_endpoint = "vpn.example.com:443"
 use_proxy       = "socks5://127.0.0.1:1080"
 ```
 
-Or via the CLI:
+Or, if you are passing everything on the command line rather than via a config file:
 
 ```bash
-./konduit connect --config client.toml --use-proxy socks5://127.0.0.1:1080
+./konduit connect \
+  --server vpn.example.com:443 \
+  --peer-id "$PEER_ID" \
+  --identity "$IDENTITY_HEX" \
+  --server-pub "$SERVER_PUB_HEX" \
+  --use-proxy socks5://127.0.0.1:1080
 ```
 
+`--config` and `--use-proxy` cannot be combined. `--config` is a top-level flag, while `--use-proxy` belongs to the `connect` subcommand, so a single invocation has to pick one style. Mixing them fails with `error: unexpected argument '--use-proxy' found`.
+
 Konduit dials the SOCKS5 proxy, asks it to `CONNECT` to your server, and then runs its normal protocol over that connection — the proxy is otherwise transparent to it. If the proxy is unreachable, or requires authentication konduit doesn't support, the connection attempt fails immediately; there is no silent fallback to a direct connection.
 
 ## Listener: exposing a SOCKS5 proxy after the tunnel is up (`listen_socks`)
@@ -31,10 +38,15 @@ Once connected, konduit can also expose a local SOCKS5 listener so other tools (
 listen_socks = "127.0.0.1:1080"
 ```
 
-Or via the CLI:
+Or via the `connect` subcommand, as above — `--listen-socks` takes a bare address:
 
 ```bash
-./konduit connect --config client.toml --listen-socks 127.0.0.1:1080
+./konduit connect \
+  --server vpn.example.com:443 \
+  --peer-id "$PEER_ID" \
+  --identity "$IDENTITY_HEX" \
+  --server-pub "$SERVER_PUB_HEX" \
+  --listen-socks 127.0.0.1:1080
 ```
 
 Connections accepted by the listener are plain outbound TCP connections, routed through the tunnel by the kernel's routing table — the same routes any other tunnelled traffic uses. The SOCKS code itself has no VPN-specific logic.