diff --git a/host-setup/linux/README.md b/host-setup/linux/README.md
index 0e241b4a8..3e69c984a 100644
--- a/host-setup/linux/README.md
+++ b/host-setup/linux/README.md
@@ -119,6 +119,8 @@ Two steps cannot be automated, because they happen in a browser. The public key
 
 **`--shared-checkout` exists because `safe.directory` and `core.sharedRepository` are relaxations, not defaults.** They are applied only for a path the caller names, and a host one account uses needs neither. `*` is accepted but called out as turning the ownership check off everywhere.
 
+**`--gh-ssh-protocol` exists because rewriting a working authentication setup is the operator's call.** A plain run reports gh's github.com git protocol and `--configure` alone leaves it as found. `--configure --gh-ssh-protocol` sets it to ssh. It warns and sets nothing where gh is not installed or not logged in. A protocol set before a login leaves a tokenless entry that gh reports as a failed login.
+
 ## install-skills.sh Is the Exception
 
 The sibling scripts are independently fetchable, and this one deliberately is not. It drives `scripts/skills_install.py` at the tree root, and the skills content lives in the tree, so a copy fetched alone has nothing to install. Python 3.7 or later is its one dependency, which is why the bootstrap runs it last. Run on a host without one, it stops and names the tools step as its prerequisite.
diff --git a/host-setup/windows/README.md b/host-setup/windows/README.md
index 909566f7d..79c2f8445 100644
--- a/host-setup/windows/README.md
+++ b/host-setup/windows/README.md
@@ -19,6 +19,8 @@ host-setup\windows\setup-github.ps1 -Status
 host-setup\windows\setup-wsl.ps1 -Status
 ```
 
+`setup-github.ps1` reports gh's github.com git protocol and `-Configure` alone leaves it as found, since rewriting a working authentication setup is the operator's call. `-Configure -GhSshProtocol` sets it to ssh. It warns and sets nothing where gh is not installed or not logged in. A protocol set before a login leaves a tokenless entry that gh reports as a failed login.
+
 ## Requirements
 
 **PowerShell 7 or later**, which is `pwsh` rather than the `powershell.exe` that ships with Windows. Each script refuses an older one and prints `winget install --id Microsoft.PowerShell --exact --source winget` as the remedy. `pwsh` is deliberately not a managed tool: a host that cannot run these scripts cannot be repaired by them.