diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..a93fc39
--- /dev/null
+++ b/.env.example
@@ -0,0 +1 @@
+ARGOCD_ADMIN_PASSWORD=
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4c49bd7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/README.md b/README.md
index a1603c4..88b6147 100644
--- a/README.md
+++ b/README.md
@@ -45,40 +45,24 @@ helm version
 
 ---
 
-## Phase 2 — Fill in NFS details
-
-Edit `manifests/nfs-provisioner/values.yaml` before pushing — replace the two placeholders:
+## Phase 2 — Set credentials
 
 ```bash
-git clone https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+cp .env.example .env
 ```
 
-```bash
-cd cluster-bootstrap
-```
-
-Open `manifests/nfs-provisioner/values.yaml` and set:
-- `nfs.server` — xpen NAS IP address
-- `nfs.path` — NFS export path (e.g. `/volume1/k8s`)
-
-Then commit and push:
-
-```bash
-git add manifests/nfs-provisioner/values.yaml
-```
-
-```bash
-git commit -m "set nfs server and path"
-```
-
-```bash
-git push origin main
-```
+Edit `.env` and set `ARGOCD_ADMIN_PASSWORD` to your desired password. This file is gitignored — never commit it.
 
 ---
 
 ## Phase 3 — Install ArgoCD
 
+Install `httpd-tools` for bcrypt hash generation (one-time):
+
+```bash
+sudo dnf install -y httpd-tools
+```
+
 Add Helm repo:
 
 ```bash
@@ -89,10 +73,10 @@ helm repo add argo https://argoproj.github.io/argo-helm
 helm repo update
 ```
 
-Install ArgoCD:
+Install ArgoCD with your password from `.env`:
 
 ```bash
-helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml
+source .env && BCRYPT=$(htpasswd -nbBC 10 "" "$ARGOCD_ADMIN_PASSWORD" | tr -d ':\n' | sed 's/$2y/$2a/') && helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml --set configs.secret.argocdServerAdminPassword="$BCRYPT" --set configs.secret.argocdServerAdminPasswordMtime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 ```
 
 Wait for ArgoCD to be ready:
@@ -101,19 +85,13 @@ Wait for ArgoCD to be ready:
 kubectl wait --for=condition=available deployment/argocd-server -n argocd --timeout=120s
 ```
 
-Get initial admin password:
-
-```bash
-kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath='{.data.password}' | base64 -d
-```
-
 Port-forward to access UI (MetalLB + Envoy not running yet):
 
 ```bash
 kubectl port-forward svc/argocd-server -n argocd 8080:443
 ```
 
-Open `https://localhost:8080` — login with `admin` and the password above.
+Open `https://localhost:8080` — login with `admin` and the password from your `.env`.
 
 ---