diff --git a/README.md b/README.md
index 4f4ff81..5dc65a2 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,9 @@ these custom users are properly authenticated.
 
 ### Configuring factoriauth
 
-Copy `config.toml.example` to `config.toml` and adjust as necessary.
+Copy `config.toml.example` to `config.toml` and adjust as necessary. `padlock-secret` needs to be a
+hex-encoded binary string of at least 32 bytes - either generate your own, or attempt to start
+factoriauth once and copy the freshly generated secret from the error message.
 
 #### LDAP authentication backend notes