diff --git a/README.md b/README.md
index 04c55ef..df986ce 100644
--- a/README.md
+++ b/README.md
@@ -35,14 +35,46 @@ unless you explicitly enable `INCLUDE_RAW_KEY_IN_ZIP=true`. Treat both the ZIP
 and its password as sensitive.
 
 ```mermaid
-flowchart LR
-    A[Local Smallstep CA] -->|issue| B[Client identity]
-    B --> C[PEM certificate and key]
-    B --> D[PKCS#12 bundle]
-    D --> E[Optional ZIP for transfer]
+flowchart TD
+    subgraph Local[Private operator machine]
+        CA["Smallstep CA: private state in ./step"]
+        CERT["Public PEM client certificate"]
+        KEY["Secret client private key: generated locally by step CLI"]
+        CSV["issued_passwords.csv: plaintext passwords, mode 0600"]
+        P12["Password-protected PKCS#12: certificate + private key"]
+        ZIP["ZIP: protected PKCS#12 + public CA/client certificates"]
+        CA -->|sign or renew certificate| CERT
+        CERT -->|package| P12
+        KEY -->|package locally| P12
+        CSV -->|password for packaging| P12
+        P12 --> ZIP
+    end
+    ZIP -->|optional serve-certs.sh| HTTP["Temporary HTTP download: trusted LAN only"]
+    HTTP --> CLIENT["Client imports PKCS#12 using its password"]
+    ZIP -->|operator-managed secure transfer| CLIENT
+    CLIENT -->|presents client certificate over TLS| SERVICE["Service validates certificate against trusted CA"]
+    CA -.->|revoke prevents future renewal| REVOKED["Revoked certificate"]
+    REVOKED -.->|early rejection requires service-side CRL/OCSP checks| SERVICE
 ```
 
-This diagram shows the local packaging workflow. The default Compose deployment
+In text: the `step` CLI generates the client private key on the operator's
+machine and requests a signed public certificate from the CA. The CA does not
+receive or generate the client private key.
+`cert-manager.sh renew CLIENT_NAME` renews the certificate in place and rebuilds
+the PKCS#12 and ZIP using the latest password in the local plaintext log.
+The ZIP is not itself encrypted: its PKCS#12 is password-protected. Deliver the
+bundle and password through trusted channels chosen by the operator; the scripts
+do not arrange a separate secure password-delivery channel. Importing the bundle
+does not configure a server: the relying service must trust the CA and enforce
+client-certificate validation.
+
+The optional HTTP download is temporary but not authenticated or encrypted.
+It exposes the selected ZIP to anyone who can reach the listener while it runs.
+Do not expose it to the Internet or use it to serve CA state, PEM private keys,
+or the password log. See the [security model](#security-model) and the
+[Nginx Proxy Manager integration guide](docs/nginx-proxy-manager.md).
+
+Revocation is not an automatic disconnect mechanism. The default Compose deployment
 does not configure active revocation checking or a CRL endpoint, and open-source
 step-ca does not provide OCSP. Do not assume that revoking a certificate makes
 an already issued certificate unusable at relying services before expiry.