diff --git a/demo/README.md b/demo/README.md
index 831bb98..c131245 100644
--- a/demo/README.md
+++ b/demo/README.md
@@ -163,22 +163,36 @@ dashboard can never inflate the numbers it reports.
 
 ## Deployment
 
-Runs on an exe.dev VM (`htmlwire`), Ubuntu 24.04, Node 24 at `/opt/node`,
-managed by `htmlwire.service`. The platform proxy terminates TLS and forwards
-to `127.0.0.1:8000`, so the app speaks plain HTTP while the browser still gets
-`https://` and `wss://` — which is what makes the WebSocket pane work in
-production where the local self-signed cert failed.
-
-```bash
-# redeploy
-rsync -az --delete --exclude node_modules --exclude tmp --exclude results \
-  demo package.json htmlwire.exe.xyz:~/htmlwire/
-ssh htmlwire.exe.xyz 'cd ~/htmlwire && npm install --omit=dev && sudo systemctl restart htmlwire'
-
-ssh htmlwire.exe.xyz 'sudo journalctl -u htmlwire -f'   # logs
-ssh exe.dev share set-private htmlwire                  # close it back up
+Runs behind a TLS-terminating proxy that forwards to `127.0.0.1:8000`, so the
+app speaks plain HTTP while the browser still gets `https://` and `wss://` —
+which is what makes the WebSocket pane work in production, where the local
+self-signed cert failed.
+
+The app binds **loopback only**; nothing but the proxy can reach it. Because it
+is a public service with no authentication, the systemd unit confines it:
+
+```ini
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/srv/htmlwire/logs      # the only writable path
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+SystemCallFilter=@system-service
+MemoryMax=1G                           # above the app's own connection caps
+TasksMax=256
 ```
 
+`MemoryDenyWriteExecute` is deliberately absent — it breaks V8's JIT and the
+process will not start with it.
+
+Redeploy is an rsync of `demo/` plus `systemctl restart`.
+
 ### Why this host and not Cloudflare Workers
 
 The exe.dev proxy is transparent to both compression schemes, verified on the