diff --git a/README.md b/README.md
index 1140ec4..215e2d6 100644
--- a/README.md
+++ b/README.md
@@ -152,11 +152,23 @@ Most commonly set:
   (default `debian-bookworm`, auto-pulled from the catalog if not
   local).
 - `ssh_key_path` — host SSH key. If unset, banger creates
-  `~/.local/state/banger/ssh/id_ed25519`.
+  `~/.local/state/banger/ssh/id_ed25519`. Accepts absolute paths or
+  `~/`-anchored paths; `~/foo` expands against `$HOME`. Relative
+  paths are rejected at config load.
 - `firecracker_bin` — override the auto-resolved `PATH` lookup.
 
 Full key list in `internal/config/config.go`.
 
+> **Migration note.** The auto-generated default moved from
+> `~/.config/banger/ssh/id_ed25519` to
+> `~/.local/state/banger/ssh/id_ed25519`. If you have the old path
+> hardcoded in `config.toml`, either keep it (banger preserves the
+> directory when `ssh_key_path` points inside it) or unset the key
+> and banger will manage the new default for you. The first time the
+> daemon starts against the new default, guest VMs need a fresh
+> workspace sync (`banger vm stop && start`, or `--rm` flows are
+> unaffected) so their `authorized_keys` pick up the new fingerprint.
+
 ### `vm_defaults` — sizing for new VMs
 
 Every `vm run` / `vm create` prints a `spec:` line up front showing