diff --git a/README.md b/README.md
index 250e288..3b499a3 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,10 @@ Self-hosted Forgejo git server for archiving GitHub repos and mirroring active o
 
 ## Architecture
 
-- **EC2**: t4g.small (arm64), Amazon Linux 2023, 50GB gp3 EBS — instance `i-0d3005fb3c36124cd`
+- **EC2**: t4g.small (arm64), Amazon Linux 2023, 50GB gp3 EBS — look up instance ID with:
+  ```
+  aws cloudformation describe-stacks --stack-name forgejo --query 'Stacks[0].Outputs[?OutputKey==`InstanceId`].OutputValue' --output text
+  ```
 - **Network**: Private subnet (us-east-1a), behind `seahaven-com` ALB for SSL termination
 - **DNS**: `forgejo.seahaven.com` — Route53 alias record pointing to the `seahaven-com` ALB (not a direct A record)
 - **TLS**: Wildcard cert on ALB, HTTP internally on port 3000
@@ -148,7 +151,8 @@ sudo /usr/local/bin/forgejo-refresh-tokens.sh
 After the stack deploys, connect via SSM and create the admin user:
 
 ```bash
-aws ssm start-session --target i-0d3005fb3c36124cd
+INSTANCE_ID=$(aws cloudformation describe-stacks --stack-name forgejo --query 'Stacks[0].Outputs[?OutputKey==`InstanceId`].OutputValue' --output text)
+aws ssm start-session --target "$INSTANCE_ID"
 
 sudo -u forgejo /usr/local/bin/forgejo admin user create \
   --admin \
@@ -200,7 +204,8 @@ CI/CD is handled by GitHub Actions — PRs run CI, merges to `main` deploy via t
 After the first deploy with the 3-2-1 changes, the running instance's backup script still uses the old S3 path (without the `archive/` prefix). Update it via SSM:
 
 ```bash
-aws ssm start-session --target i-0d3005fb3c36124cd
+INSTANCE_ID=$(aws cloudformation describe-stacks --stack-name forgejo --query 'Stacks[0].Outputs[?OutputKey==`InstanceId`].OutputValue' --output text)
+aws ssm start-session --target "$INSTANCE_ID"
 sudo sed -i 's|s3://forgejo-backups-328440206208/${TIMESTAMP}/|s3://forgejo-backups-328440206208/archive/${TIMESTAMP}/|' /usr/local/bin/forgejo-backup.sh
 ```
 
@@ -217,7 +222,8 @@ aws secretsmanager create-secret --name forgejo/slack-webhook \
 Update the `FORGEJO_VERSION` constant in `lib/forgejo-stack.ts` and deploy. This replaces the instance, so ensure the latest EBS snapshot is available for data recovery if needed. Alternatively, update in-place via SSM:
 
 ```bash
-aws ssm start-session --target i-0d3005fb3c36124cd
+INSTANCE_ID=$(aws cloudformation describe-stacks --stack-name forgejo --query 'Stacks[0].Outputs[?OutputKey==`InstanceId`].OutputValue' --output text)
+aws ssm start-session --target "$INSTANCE_ID"
 
 sudo systemctl stop forgejo
 sudo curl -Lo /usr/local/bin/forgejo "https://codeberg.org/forgejo/forgejo/releases/download/v<NEW_VERSION>/forgejo-<NEW_VERSION>-linux-arm64"