diff --git a/server/README.md b/server/README.md
index 46e2090..1b533bf 100644
--- a/server/README.md
+++ b/server/README.md
@@ -9,7 +9,10 @@ algorithm itself -- it just streams the response straight to the panel.
 ## Setup
 
 1. **Get an Immich API key**: in Immich, go to Account Settings -> API Keys
-   -> New API Key. Read-only access to albums/assets is enough.
+   -> New API Key. Needs read access to albums/assets/faces, plus
+   `sharedLink.create` (for the manage overlay's "scan to download" QR,
+   which creates a temporary public share link) -- a plain read-only key
+   will 403 on that one specific feature while everything else works.
 2. **Copy the compose file and fill in your Immich details**:
    ```
    cp docker-compose.yml.example docker-compose.yml