diff --git a/README.md b/README.md
index 20f359a..8981d63 100644
--- a/README.md
+++ b/README.md
@@ -44,6 +44,14 @@ the agent's token (shown once) and the master's key fingerprint; the same layout
 | `DOCKER_CONFIG` | no | — | Directory with a `config.json` holding registry credentials. Only inline `auths` entries work; `credsStore`/`credHelpers` are not available in the container. |
 | `LOG_LEVEL` | no | `info` | `debug` / `info` / `warn` / `error`. |
 
+### Registry credentials
+
+With `DOCKER_CONFIG` set, Compose jobs pull with the same credentials as `docker compose`.
+For Swarm jobs the agent passes the matching registry's credentials with the service
+update (same as `docker service update --with-registry-auth`), so Swarm stores them in the
+cluster and hands them to the nodes that pull the image. Only the entry for the image's
+registry host is ever sent.
+
 ### Mounting stack directories
 
 There is no `STACKS_ROOT`. The agent may only touch Compose stacks in directories that