diff --git a/CLAUDE.md b/CLAUDE.md
index 1ee62ee..aa7fa7e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -45,6 +45,11 @@ Container defaults `WishNinja__DataPath=/data` and listens on `:8080`. Key vars:
 email links), `WishNinja__Smtp__*` (optional; if unset, emails are logged and invite links show in
 the admin UI). Full table in the README.
 
+**Production email is configured** via a Gmail **App Password** (`smtp.gmail.com:587` STARTTLS),
+stored in the Unraid template (masked). Invites + password resets both use it. See the README
+"Email (Gmail example)" section. Reminder: SMTP vars must live in the Unraid *template*, not just
+the running container, or a Force Update wipes them.
+
 ## Deployment (production)
 - **Repo:** `https://git.basso.land/jim/WishNinja` (Gitea). Push to `main` → Gitea Actions runs
   tests, builds the Docker image, pushes `git.basso.land/jim/wishninja:latest` + a SHA tag.
diff --git a/README.md b/README.md
index c744a88..58ec1ab 100644
--- a/README.md
+++ b/README.md
@@ -54,6 +54,32 @@ All settings are environment variables (double-underscore maps to nested config)
 
 The container listens on **port 8080** over plain HTTP — terminate TLS at your reverse proxy.
 
+### Email (Gmail example)
+
+Invites and password resets need SMTP. Gmail works via an **App Password** (not your account
+password):
+
+1. Enable **2-Step Verification** on the Google account, then create an App Password at
+   <https://myaccount.google.com/apppasswords>. You get a 16-character password — use it **without
+   spaces**.
+2. Set the SMTP variables:
+
+   | Variable | Value |
+   |---|---|
+   | `WishNinja__Smtp__Host` | `smtp.gmail.com` |
+   | `WishNinja__Smtp__Port` | `587` |
+   | `WishNinja__Smtp__UseStartTls` | `true` |
+   | `WishNinja__Smtp__User` | your full Gmail address |
+   | `WishNinja__Smtp__Password` | the 16-char app password (no spaces) |
+   | `WishNinja__Smtp__FromAddress` | same Gmail address (Gmail requires From = authenticated user) |
+   | `WishNinja__Smtp__FromName` | e.g. `WishNinja` |
+
+Other providers work the same way — just swap Host/Port/User/Password. Leave `Smtp__Host` empty to
+disable email entirely (invite links still appear in the admin UI).
+
+> **Unraid note:** set these as container variables via the template so they persist across
+> *Force Update* redeploys — variables added only to a running container are lost on recreate.
+
 ## Running on Unraid
 
 1. **Build & publish the image.** Push to your Gitea repo; the included