diff --git a/README.md b/README.md
index d19bb41..674bbe8 100644
--- a/README.md
+++ b/README.md
@@ -14,15 +14,31 @@ Infrastructure-as-Code for a CachyOS Linux workstation, managed with Ansible.
 - **Entry point:** `site.yml`
 - **Structure:** Roles with tags for selective execution
 
-## Prerequisites
+## New Machine Bootstrap
 
-- Ansible installed on the workstation
-- A working Python environment (required by Ansible)
+On a fresh machine, run `bootstrap.yml` first. It handles the prerequisites that
+`site.yml` depends on:
 
-Install prerequisites manually before running the playbook:
+1. Installs and authenticates Tailscale
+2. Imports GPG keys from the local git server
+3. Clones the pass password store
+
+Prerequisites before running bootstrap:
 
 ```bash
-sudo pacman -S ansible ansible-lint
+sudo pacman -S ansible git
+```
+
+Run bootstrap:
+
+```bash
+ansible-playbook -K -i inventory/hosts.yml bootstrap.yml
+```
+
+Then run the full site playbook:
+
+```bash
+ansible-playbook -K -i inventory/hosts.yml site.yml
 ```
 
 ## Usage
@@ -30,29 +46,44 @@ sudo pacman -S ansible ansible-lint
 Run the full site playbook:
 
 ```bash
-ansible-playbook site.yml
+ansible-playbook -K -i inventory/hosts.yml site.yml
 ```
 
 Run only tasks matching a specific tag:
 
 ```bash
-ansible-playbook site.yml --tags <tagname>
+ansible-playbook -K -i inventory/hosts.yml site.yml --tags <tagname>
 ```
 
 Skip tasks matching a tag:
 
 ```bash
-ansible-playbook site.yml --skip-tags <tagname>
+ansible-playbook -K -i inventory/hosts.yml site.yml --skip-tags <tagname>
 ```
 
+## Roles
+
+| Role | Play | Description |
+|------|------|-------------|
+| firewall | system | ufw, default deny incoming, allow port 22 |
+| packages | system | General packages via pacman |
+| docker | system | Docker, enables service, adds user to docker group |
+| virtualization | system | qemu-full, virt-manager, libvirtd |
+| web | system | hcloud, hugo, tea |
+| flatpak | system | Flatpak and apps, MakeMKV device permissions |
+| gpg | user | Import GPG keys from private git repo |
+| ssh | user | Deploy SSH keys and config from pass |
+| pass | user | Clone pass password store |
+| dotfiles | user | Clone dotfiles and nvim repos, symlink configs |
+| scripts | user | Clone scripts repo, add to PATH, deploy Pushover credentials |
+| hotkeys | user | Deploy .desktop files, set Plasma 6 global shortcuts |
+
 ## Structure
 
 ```
 .
+├── bootstrap.yml     # New machine bootstrap
 ├── site.yml          # Main entry point
 ├── inventory/        # Inventory files
-├── roles/            # Ansible roles
-└── group_vars/       # Variables by group
+└── roles/            # Ansible roles
 ```
-
-> Structure will grow as roles are added.