diff --git a/.gitignore b/.gitignore
index 7ed67fe..70cb9d2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@ out-dir/
 thumbs/
 *.log
 cache/
+push.json
diff --git a/README.md b/README.md
index 6aa8828..989a004 100644
--- a/README.md
+++ b/README.md
@@ -507,3 +507,16 @@ Notes:
 - If the Gemini API returns an error (HTTP 429 or 503) the response and details are written to the job log (`<inputdir>/generate_data.log`) and debug response file when available.
 
 If you prefer a background/async workflow instead of the synchronous popup, the endpoint and UI can be adjusted to start the job in the background and poll for results instead.
+
+
+Push VAPID keys (push.json)
+
+- push.json contains the VAPID keys used by the server for web-push.
+- Do NOT commit push.json to git. Use push.json.example as a template.
+
+To install on the server (example):
+
+sudo cp push.json.example push.json
+sudo chown root:www-data push.json
+sudo chmod 640 push.json
+
diff --git a/push.json.example b/push.json.example
new file mode 100644
index 0000000..50eff1f
--- /dev/null
+++ b/push.json.example
@@ -0,0 +1,4 @@
+{
+  "vapidPublicKey": "REPLACE_WITH_PUBLIC_KEY",
+  "vapidPrivateKey": "REPLACE_WITH_PRIVATE_KEY"
+}