diff --git a/server/DEPLOY.md b/server/DEPLOY.md
index 4e753a4..307e73c 100644
--- a/server/DEPLOY.md
+++ b/server/DEPLOY.md
@@ -4,7 +4,16 @@ Single-tenant PHP/SQLite app. Tiny — runs comfortably on the smallest VPS tier
 
 ## Requirements
 
-- PHP **8.1+** with `pdo`, `pdo_sqlite`, `json`, `mbstring` (all standard).
+- **PHP 8.1+ is required.** The code uses typed properties, `str_starts_with`,
+  `mixed`/`never` return types, named arguments, and constructor property
+  promotion. PHP 7.x will not even parse the source files. PHP 7.2 has also
+  been EOL since November 2020 — don't run a public service on it.
+
+  Confirm with `php -v`. If the box is on an older default, install a current
+  PHP alongside it (Ondrej Sury's repo is the standard on Debian/Ubuntu) and
+  point this vhost at the new FPM socket.
+
+- PHP extensions: `pdo`, `pdo_sqlite`, `json`, `mbstring` (all standard).
 - Apache + `mod_rewrite`, or nginx with a `try_files` fallback.
 - HTTPS terminating in front of PHP. Plain HTTP is technically accepted, but the plugin client will refuse to talk to non-`https://` endpoints.
 
@@ -91,7 +100,11 @@ server {
 
     location ~ \.php$ {
         include fastcgi_params;
-        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
+        # Version-agnostic — Ondrej Sury's packaging installs this symlink
+        # pointing at whichever php-fpm is the current "alternative". If the
+        # symlink doesn't exist on your box, hardcode e.g. php8.3-fpm.sock.
+        # Check with: ls -la /run/php/
+        fastcgi_pass unix:/run/php/php-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         fastcgi_param HTTP_AUTHORIZATION $http_authorization;
     }
@@ -101,6 +114,13 @@ server {
 }
 ```
 
+> **Gotcha:** nginx loads *every* file in `sites-enabled/` regardless of
+> extension. Don't `cp healthcheck.conf healthcheck.conf.bak` inside that
+> directory — the backup becomes a second vhost claiming the same
+> `server_name`, and nginx silently ignores one of them ("conflicting server
+> name … ignored" in the error log) which manifests as the new config not
+> taking effect. Back up *outside* `sites-enabled/`.
+
 ## TLS
 
 Use Let's Encrypt + certbot. Example: