diff --git a/README.md b/README.md
index 76d5d08..88a3f31 100644
--- a/README.md
+++ b/README.md
@@ -50,7 +50,18 @@ any shard's website — there is no compiled-in API host.
 
 `.gitea/workflows/pr-checks.yml` gates PRs into `main` with `./gradlew lint test assembleDebug` on the
 org's self-hosted runner (JDK 17 + Android SDK). Debug builds are auto-signed, so the gate needs no
-secrets. A signed **release** APK attached to a Gitea release comes at M6.
+secrets. **This pipeline is verified green end-to-end on the runner** (M0). A signed **release** APK
+attached to a Gitea release comes at M6.
+
+The workflow carries a few runner-specific accommodations (each explained in comments in the file),
+because this self-hosted runner differs from a stock GitHub runner:
+
+- **JDK 17 is installed via `apt`** (not `actions/setup-java`) — the runner can't resolve
+  `api.adoptium.net`, while the Ubuntu mirrors are reachable.
+- **SDK packages are installed explicitly** via `sdkmanager`, with `set +o pipefail` so `yes` dying of
+  `SIGPIPE` doesn't fail the step.
+- **`gradlew` is `chmod +x`'d in the run step** — the runner's checkout does not preserve the git
+  executable bit, so `./gradlew` alone fails with "Permission denied".
 
 ## Contributing