diff --git a/docs/image-builder-proxmox.md b/docs/image-builder-proxmox.md
index 2c49dc7..660f423 100644
--- a/docs/image-builder-proxmox.md
+++ b/docs/image-builder-proxmox.md
@@ -71,8 +71,13 @@ Notes carried into CAPMOX (phase 1): same ACL set, `vlan: 4` on the network devi
 The template has no usable login (`builder` is locked) — access only via cloud-init (NoCloud,
 which the PVE Cloud-Init drive provides):
 
+Run it on the node that holds the template. VMIDs are cluster-wide, so pick a free `ID`: 9001 is
+now `debian-13-template`, and the last line destroys `$ID`. The key file must exist on that node
+(`scp ~/.ssh/id_ed25519.pub root@<node-ip>:/root/jan.pub`).
+
 ```bash
-TPL=<template vmid>; ID=9001
+TPL=<template vmid>; ID=9901
+qm status $ID 2>/dev/null && echo "VM $ID exists, pick another ID"   # must print nothing
 qm clone $TPL $ID --name smoke-k8s --full 1 --storage local-lvm
 qm set $ID --ide2 local-lvm:cloudinit
 qm set $ID --ciuser jan --sshkeys /root/jan.pub --ipconfig0 ip=dhcp