diff --git a/README.md b/README.md
index 4a55c8c..3849eb5 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ bash ~/.bootstrap/setup.sh --only hardening
 | 5 | shell-zsh    | zsh + oh-my-zsh + plugins, set default shell, ship config (to `~$TARGET_USER/.config/zsh`) |
 | 6 | nvm          | nvm → `~$TARGET_USER/.nvm` + Node LTS                              |
 | 7 | nvim         | clone `g.mk.fo/bootstrap/nvim-minimal` → `~$TARGET_USER/.config/nvim` |
-| 8 | hardening    | ssh (key-only root), ufw, updates, unattended-upgrades, tz, hostname, swapfile, locale, fail2ban, **angie config layout** |
+| 8 | hardening    | ssh (key-only root), ufw, updates, unattended-upgrades, tz, hostname, swapfile, locale, fail2ban, **angie config layout + built-in ACME** |
 | 9 | sanity       | read-only report + recommended manual follow-ups                    |
 
 Every step is idempotent — re-running is safe.
@@ -143,6 +143,26 @@ kept at `/etc/angie/angie.conf.orig.bootstrap`.
 Defaults shipped:
 - `modules/http/00-common.conf` — `real_ip` from private ranges (Cloudflare commented), `proxy_set_header` defaults (inherited by every server/location).
 - `_on/00-default.conf` — `default_server` returning `444` for requests that match no enabled host (drops drive-by scanners / bare-IP probes).
+- `targets/example-https.conf.example` — a TLS server template using Angie's built-in ACME.
+- `angie-issue` helper — create a TLS host with a Let's Encrypt cert (no certbot).
+
+## TLS / Let's Encrypt (Angie built-in ACME — no certbot)
+
+Angie ships the `http_acme` module, so it obtains **and renews** TLS certificates
+itself — no certbot, no separate renewal cron/timer. The hardening step ships an
+example TLS host and an `angie-issue` helper:
+
+```sh
+angie-issue example.com you@email.com   # first call: writes the shared
+                                        # acme_client (Let's Encrypt) + email
+angie-issue www.example.com             # later domains reuse the same client
+```
+
+All enabled hosts using `acme default` share one certificate covering every
+`server_name` that references it; Angie requests it on reload and renews before
+expiry. The shared client lives at `/etc/angie/modules/http/acme.conf` (with a
+`resolver`, required by `acme_client`). HTTP→HTTPS redirect, `http2`, and the cert
+are wired into the target template — replace `location /` with your app/proxy.
 
 ## Notes