diff --git a/.env.example b/.env.example
index 251f6ac..72a6791 100644
--- a/.env.example
+++ b/.env.example
@@ -18,6 +18,10 @@ EVE_SSO_CLIENT_SECRET=
 # itself. A mismatch fails at login with an SSO error, not at startup.
 EVE_SSO_REDIRECT_URI=http://<docker-host-lan-ip>:8000/callback
 
+# Host port to serve on. Change it if something already uses 8000; the port you
+# pick must match the one in EVE_SSO_REDIRECT_URI above.
+EVE_ASSISTANT_PORT=8000
+
 # --------------------------------------------------------------------------
 # Who is running this instance
 # --------------------------------------------------------------------------
diff --git a/README.md b/README.md
index 53055f2..9fbc945 100644
--- a/README.md
+++ b/README.md
@@ -75,6 +75,8 @@ writable by that uid on the host:
 mkdir -p data && chown 1000:1000 data
 ```
 
+Prefix the `chown` with `sudo` unless your own account happens to be uid 1000.
+
 Skipping this is the most common first failure: the container starts and then
 cannot write its database.
 
@@ -85,17 +87,27 @@ docker login forge.narog.fr     # only while access is invite-only
 docker compose up -d
 ```
 
-### 6. Load the game data
+### 6. Log in — and claim the instance
 
-Open the app and go to **Data → Download game data**. This pulls CCP's Static
-Data Export — blueprints, recipes, systems, market groups. It is a few hundred
-megabytes and takes a few minutes.
+Open the address from your callback URL (without `/callback`) and click **Log in
+with EVE Online**. Everything below is behind this: the Data and Configuration
+pages both redirect to the login until you have done it.
+
+**The first character to log in claims the instance.** After that an unknown
+character is refused unless you are already logged in and adding it yourself. So
+log in once before the port is reachable by anyone else.
+
+### 7. Load the game data
+
+**Data → Download game data.** This pulls CCP's Static Data Export — blueprints,
+recipes, systems, market groups. It is a few hundred megabytes and takes a few
+minutes.
 
 Nothing works before this: the database schema exists but is empty, so every
 planner renders blank. Re-run it after a game patch; nothing does it on a
 schedule.
 
-### 7. Configure, in this order
+### 8. Configure, in this order
 
 Go to **Configuration**. The order matters — later steps depend on earlier ones.
 
@@ -115,11 +127,11 @@ Go to **Configuration**. The order matters — later steps depend on earlier one
    `/reactions/config`, `/pi/config`. These are lists rather than settings, so
    they live with the view that uses them.
 
-### 8. Add your characters and pull your data
+### 9. Add your other characters and pull your data
 
-**Characters → Add a character**, then **Data → Refresh** to pull assets,
-blueprints, industry jobs and prices. Nothing is fetched in the background, so
-that button is what makes the rest of the app show anything.
+**Characters → Add a character** for each alt, then **Data → Refresh** to pull
+assets, blueprints, industry jobs and prices. Nothing is fetched in the
+background, so that button is what makes the rest of the app show anything.
 
 ## Your settings are a file you can keep
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 0a40f88..63b9d7e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,10 +10,14 @@ services:
     # a release can carry a one-way database migration, so upgrading is
     # something you do deliberately (`git pull`), not something a restart does
     # to you.
-    image: forge.narog.fr/eve-assistant/app:0.3.0
+    image: forge.narog.fr/eve-assistant/app:0.3.1
     restart: unless-stopped
     ports:
-      - "8000:8000"
+      # Host port from .env, so a port clash does not force you to edit this
+      # file -- which is generated and would be reverted by the next `git pull`,
+      # silently moving the app back to 8000 and breaking the callback URL you
+      # registered with CCP. The container side stays 8000.
+      - "${EVE_ASSISTANT_PORT:-8000}:8000"
     volumes:
       # Holds sde.db (game reference data) and app.db (your tokens, settings,
       # and the latest snapshot of your assets). Both are latest-snapshot-only