diff --git a/README.md b/README.md
index d1aa911..7418193 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,30 @@
 
 Personal file share server on AWS — Samba for macOS Finder integration and FileBrowser for web-based file management. Accessible exclusively over the site-to-site VPN.
 
+## Infrastructure (CDK)
+
+All infrastructure is defined as code with the [AWS CDK](https://docs.aws.amazon.com/cdk/) (TypeScript). The app synthesizes a single CloudFormation stack — `file-share` — that provisions everything described under [Architecture](#architecture), deployed to account `328440206208` in `us-east-1`.
+
+```
+bin/app.ts                 # CDK app entry point — instantiates the stack
+lib/file-share-stack.ts    # FileShareStack — all resource definitions
+cdk.json                   # App command + CDK feature flags / context
+cdk.context.json           # Cached VPC/subnet lookups and the resolved AL2023 AMI
+```
+
+`cdk.json` is the CDK app manifest. Its `app` command (`npx tsx bin/app.ts`) runs the TypeScript entry point directly via [tsx](https://github.com/privatenumber/tsx) — no separate compile step is needed for synth or deploy. `bin/app.ts` instantiates `FileShareStack` with an explicit `stackName: "file-share"` (kebab-case, per convention) and the target account/region.
+
+`aws-cdk-lib` is pinned to an exact version (`2.261.0`); the `aws-cdk` CLI is available as a dev dependency and via `npx cdk`.
+
+Common commands (also exposed as npm scripts):
+
+| Command | Purpose |
+|---|---|
+| `npx cdk synth` (`npm run synth`) | Synthesize the CloudFormation template to `cdk.out/` |
+| `npx cdk diff` (`npm run diff`) | Diff the synthesized stack against what is deployed |
+| `npx cdk deploy` (`npm run deploy`) | Deploy the stack |
+| `npm run build` | Type-check via `tsc` |
+
 ## Architecture
 
 - **EC2** — `t4g.small` (ARM64, Amazon Linux 2023) in the private subnet. The AMI is cached in the committed `cdk.context.json` (`cachedInContext: true`), so deploys never pick up a new AL2023 release implicitly — an AMI change forces instance replacement and must be deliberate (`cdk context --reset <ami key> && cdk synth`).