diff --git a/README.md b/README.md
index cc0aa96..25d3d2c 100644
--- a/README.md
+++ b/README.md
@@ -52,8 +52,12 @@ make run                     # scripts/run-backend.sh deploy/confluence-web.env
 
 The backend binds `127.0.0.1:8000` by default and serves the UI at
 `http://127.0.0.1:8000/`. Open it in a browser, click the key icon, enter the
-Confluence base URL and your personal access token (PAT), test the connection,
-then ask a question. Credentials live only in browser memory and in the backend
+Confluence base URL **including its context path** (for example
+`https://collab.lge.com/main`, which must match an approved origin), your
+personal access token (PAT), test the connection, then ask a question. On
+instances that allow anonymous REST reads, "Test connection" proves the
+destination is reachable but cannot prove the PAT is valid; a wrong token then
+shows up as denied or missing pages. Credentials live only in browser memory and in the backend
 for the duration of a request; a page reload clears them.
 
 Version 1 is a single-user deployment: one backend worker, one query at a time
diff --git a/deploy/confluence-web.env.example b/deploy/confluence-web.env.example
index 9dfa41e..991a5ec 100644
--- a/deploy/confluence-web.env.example
+++ b/deploy/confluence-web.env.example
@@ -5,7 +5,8 @@
 
 # --- Confluence (read-only, user PAT is supplied in the browser at query time) ---
 # Approved base origins (comma separated, include context path if any).
-CONFLUENCE_WEB_APPROVED_ORIGINS=https://collab.lge.com
+# Include the Confluence context path (collab.lge.com serves REST under /main).
+CONFLUENCE_WEB_APPROVED_ORIGINS=https://collab.lge.com/main
 # Optional outbound proxy for Confluence only (socks5://, socks5h://, http://, https://).
 CONFLUENCE_WEB_CONFLUENCE_PROXY=socks5://127.0.0.1:1560
 # Optional corporate CA bundle (PEM). Leave unset to use the system trust store.