diff --git a/README.md b/README.md
index b0b4f747..ba4ea686 100644
--- a/README.md
+++ b/README.md
@@ -122,8 +122,8 @@ If you front Tx OS with a TLS-terminating proxy that you don't control
 (Tailscale `serve`, ngrok, Cloudflare Tunnel, …), two things matter:
 
 1. **Add the public URL to `ALLOWED_ORIGINS` in `.env`.** If you skip
-   this, every authenticated request fails CORS and login appears to
-   succeed but the next request 500s.
+   this, the browser blocks every API call from the SPA with a CORS
+   error and the app appears frozen on the login screen.
 
    ```bash
    ALLOWED_ORIGINS=http://localhost:3000,https://it-demo.tail70b2bc.ts.net