diff --git a/README.md b/README.md
index 5259a80..d4e3990 100644
--- a/README.md
+++ b/README.md
@@ -88,6 +88,7 @@ Stack name: `meal-order-manager` (us-east-1)
 - **Secrets Manager** — Slack bot token
   - Migration note: the existing `meal-order-manager/form-api-key` secret remains until this change is deployed and verified, then must be deleted during post-deploy cleanup.
 - **CloudWatch Alarms** — coverage across the stack, all notifying the shared `site-alerts` SNS topic (see Monitoring)
+- **HCP Terraform** — workspace `meal-order-manager-prod` in project `seahaven-prod` is the sole apply path. Working directory `terraform/`. VCS file triggers use `trigger-patterns = [terraform/**/*, src/**/*, functions/**/*]` because `terraform/build_packages.sh` packages the shared layer from `src/shared` and the handlers from `functions/`. A `src/`-only or `functions/`-only merge must still queue a run. Do not `terraform apply` locally to prod.
 
 ## Monitoring
 
@@ -196,6 +197,7 @@ meal-order-manager/
 │   ├── weekly-menu.yml          # Monday cron: scrape + publish + notify
 │   ├── ci.yml                   # PR checks
 │   └── deploy.yml               # Push to main: sam deploy
+├── terraform/                   # HCP Terraform (workspace meal-order-manager-prod)
 ├── src/
 │   ├── scraper/                 # Playwright menu scraper
 │   ├── server/                  # Form generator + local Flask server