diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,10 @@
 `ldap-scim-bridge` uses [PVP][1]-compatible versioning.
 The changelog is available [on GitHub][2].
 
+## 0.6
+
+- Work on README (#20)
+
 ## 0.5
 
 - Various small fixes (#15)
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -6,15 +6,17 @@
 [![Stackage Nightly](http://stackage.org/package/ldap-scim-bridge/badge/nightly)](http://stackage.org/nightly/package/ldap-scim-bridge)
 [![AGPL-3.0-only license](https://img.shields.io/badge/license-AGPL--3.0--only-blue.svg)](LICENSE)
 
-## this is work in progress.  use at your own risk?
-
 ## intro
 
 This is a small command line tool to pull data from an LDAP server and
-push it to a SCIM peer.  It supports fields `externalId`,
-`userName`, `displayName`, `emails`, in the `User` schema.  It may not
-support any other fields, and it does not support scim `Group`s.
+push it to a SCIM peer.  It is currently used in production togethre
+with [wire-server](https://github.com/wireapp/wire-server), but is
+designed as a more general tool.
 
+It supports fields `externalId`, `userName`, `displayName`, `emails`,
+in the `User` schema.  It may not support any other fields, and it
+does not support scim `Group`s.
+
 If you extend this to other fields, groups, or other use cases and setups, we
 would highly appreciate pull requests, tickets, or emails (no matter how half-baked).
 
@@ -36,37 +38,43 @@
 See [ldif](./ldif/README.md) for a few sample user records to play with.
 A working example can be found in `./examples/wire-server`.
 
-## future work
+## use via docker
 
-Support more SCIM attributes and extensions.
-Specifically, for
-[wire-server](https://github.com/wireapp/wire-server), we may want to
-add rich profiles:
+If you have gotten here as a
+[wire-server](https://github.com/wireapp/wire-server) administrator
+and want to use this to populate your teams, you can use the docker
+image we're building from this repo:
 
+```sh
+docker pull quay.io/wire/ldap-scim-bridge:0.5
 ```
-      { ...,
-        "urn:wire:scim:schemas:profile:1.0": {
-          "richInfo": {
-            "version": 0,
-            "fields": [
-              {
-                "value": "hair color",
-                "type": "green"
-              },
-              {
-                "value": "title",
-                "type": "galactic overlord"
-              }
-            ]
-          }
-        },
-        "urn:ietf:params:scim:schemas:extension:wire:1.0:User": {
-          "hair color": "green",
-          "title": "galactic overlord"
-        },
-        ...
-      }
+
+You need to create a config file that contains your setup.  If in doubt, you can start with [this example](./examples/wire-server/conf1.yaml), or [this one](./examples/wire-server/conf2.yaml).  Name the file `config.yaml` and place it into `/config-path`.  Let's say you want to work on release 0.5.  (You can check if there is a `:latest`, but at the time of writing this paragraph, we still have to add that.)
+
+```sh
+docker run -it --network=host \
+  --mount type=bind,src=/config-path,target=/mnt \
+  quay.io/wire/ldap-scim-bridge:0.5 \
+  ldap-scim-bridge /mnt/config.yaml
 ```
+
+This should work fine for Windows if you make sure the file path under `src` points to the right place.  You may need to you `\` instead of `/`.
+
+The connection to wire is not encrypted.  This tool is made for running inside the trusted network the backend is running in.  If you need to protect this connection you can use an off-the-shelf tls tunnel or vpn solution.
+
+The connection to the LDAP source is TLS-encrypted.  If you need to add trusted certificates to the store in `/etc/ssl/certs/`, you can just mount it:
+
+```sh
+docker run -it --network=host \
+  --mount type=bind,src=/config-path,target=/mnt \
+  --mount type=bind,src=/etc/ssl/certs,target=/etc/ssl/certs \
+  quay.io/wire/ldap-scim-bridge:0.5 \
+  ldap-scim-bridge /mnt/config.yaml
+```
+
+## future work
+
+See https://github.com/wireapp/ldap-scim-bridge/issues
 
 ## further reading
 
diff --git a/ldap-scim-bridge.cabal b/ldap-scim-bridge.cabal
--- a/ldap-scim-bridge.cabal
+++ b/ldap-scim-bridge.cabal
@@ -1,6 +1,6 @@
 cabal-version:       2.4
 name:                ldap-scim-bridge
-version:             0.5
+version:             0.6
 synopsis:            See README for synopsis
 description:         See README for description
 homepage:            https://github.com/fisx/ldap-scim-bridge