diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7345372..79f327a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,7 +58,8 @@ jobs:
             Test build `.elf` — no PKG yet.
 
             1. Delete the `/data/orbisRPC` folder from your PS4 first.
-            2. Run the payload once — it creates the config, then waits (no token yet).
+            2. Put the `.elf` at `/data/payloads/` and launch it from the payload list.
+            3. First run creates the config, then waits (no token yet).
             3. Open `/data/orbisRPC/config.json`, put your token in the `"token": "SET_ME"` slot.
             4. Re-run the payload. Launch a game, watch Discord.
 
diff --git a/README.md b/README.md
index 0925a92..3af00ac 100644
--- a/README.md
+++ b/README.md
@@ -94,15 +94,17 @@ Details: [`docs/DAEMON.md`](docs/DAEMON.md) · full index at [`docs/`](docs/)
 
 1. Before launching, delete the `/data/orbisRPC` folder from your PS4 if
    you have one there from an earlier build.
-2. Run the payload first time — it'll create the config file, then say
-   there's no token yet.
-3. Open `/data/orbisRPC/config.json` and add your account token in the
+2. Put the `.elf` on the console at `/data/payloads/` (FTP it over, or
+   USB) — that's where GoldHEN looks for payloads.
+3. Launch it from the payload list. First run creates the config file,
+   then says there's no token yet.
+4. Open `/data/orbisRPC/config.json` and add your account token in the
    `"token": "SET_ME"` slot.
-4. After setting the token, re-run the payload. Launch a game and watch
-   Discord. Give feedback in `testers-chat`.
+5. After setting the token, re-run the payload from `/data/payloads`.
+   Launch a game and watch Discord. Give feedback in `testers-chat`.
 
-After a reboot just re-jailbreak and re-send the payload — don't use
-Payload Guest for this.
+After a reboot just re-jailbreak and launch the payload from
+`/data/payloads` again.
 
 **Upgrading test builds:** as usual, delete the `/data/orbisRPC` folder
 before using a new test build — and you'll have to re-add your token in
diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md
index 9578b98..47649b6 100644
--- a/docs/TROUBLESHOOTING.md
+++ b/docs/TROUBLESHOOTING.md
@@ -65,8 +65,10 @@ Never share the config file — a user token is full account access.
 
 ## Payload won't start
 
-- Send it via elfldr (port 9021) or the BinLoader server (port 9020).
-  Don't use Payload Guest for orbisRPC.
+- The payload lives at `/data/payloads/` — put the `.elf` there (FTP/USB)
+  and launch it from the payload list. Don't use Payload Guest for orbisRPC.
+- No sender handy? elfldr (port 9021) or the BinLoader server (port 9020)
+  also work — see [`injecting.md`](injecting.md).
 - Ports closed? GoldHEN's BinLoader toggle is off, or the console
   rebooted to stock — re-jailbreak first.
 - Reboot wipes jailbreak + daemon (RAM-only). Re-jailbreak, re-send.