diff --git a/docs/put-backup-object-storage.md b/docs/put-backup-object-storage.md
index bf979f5..ceff57b 100644
--- a/docs/put-backup-object-storage.md
+++ b/docs/put-backup-object-storage.md
@@ -61,8 +61,16 @@ Same four field names as the bootstrap path. External Secrets projects
 `ACCESS_KEY` / `SECRET_KEY` to Kubernetes `ACCESS_KEY_ID` /
 `ACCESS_SECRET_KEY`.
 
-Optional later field: `APPLICATION_ID` (the `resource-control` IAM
-application UUID, not a secret) so we can attach a bucket policy.
+Optional field for the bucket policy (not a secret):
+
+```bash
+bao kv patch platform/workloads/railiance/backup/object-storage \
+  APPLICATION_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
+```
+
+Copy the UUID from IAM → Applications → `resource-control`. Then tell
+the agent **“APPLICATION_ID is in bao.”** They will run
+`reef-storage/tools/apply-backup-bucket-policy.sh`.
 
 ## 4. Confirm without printing values