diff --git a/deployments/openbao/README.md b/deployments/openbao/README.md
index 3a1d05e..16d0a60 100644
--- a/deployments/openbao/README.md
+++ b/deployments/openbao/README.md
@@ -53,9 +53,13 @@ who connects):
 docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \
   bao operator init -tls-skip-verify           # prints 5 unseal keys + root token
 docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \
-  bao operator unseal -tls-skip-verify <key>   # x3, three different keys
+  bao operator unseal -tls-skip-verify         # x3, prompts hidden each time
 ```
 
+Pass **no key argument** — `unseal` prompts with echo off. A key given on the
+command line lands in the docker process's argv, which `/proc/<pid>/cmdline`
+exposes to every user on the host; three of them reconstruct the master key.
+
 **Store the unseal keys + root token out of band** — ideally age-encrypted with
 your backup recipient (`globals/age-pubkey.txt`), never on this host.
 
diff --git a/deployments/openbao/deploy.sh b/deployments/openbao/deploy.sh
index 7e91262..b0901b1 100644
--- a/deployments/openbao/deploy.sh
+++ b/deployments/openbao/deploy.sh
@@ -489,7 +489,10 @@ TLS:        ${STACK_DIR}/tls/tls.crt  (give this to the Kanrisha daemon as
      docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \\
        bao operator init -tls-skip-verify
      docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \\
-       bao operator unseal -tls-skip-verify <key>     # x3, three different keys
+       bao operator unseal -tls-skip-verify           # x3, three different keys
+   Pass NO key argument: it then prompts with echo off. A key on the command
+   line lands in the docker process's argv, and /proc/<pid>/cmdline is
+   world-readable -- three of those reconstruct the master key.
 
 2. Bootstrap for Kanrisha. Run the Kanrisha repo's deploy/openbao/bootstrap.sh
    from a host that HAS the 'bao' CLI (the Kanrisha host or your workstation --