diff --git a/README.md b/README.md
index 1a4df68..e47a9c5 100644
--- a/README.md
+++ b/README.md
@@ -196,6 +196,15 @@ ephemeral or pre-authorized auth key outside Git, either in
 LAB_PIMOX_WORKER_TAILSCALE_ENABLED=true ./jeannie up
 ```
 
+When applying `bootstrap/cluster` directly, use the OpenTofu variable name
+instead of the Jeannie `LAB_` wrapper:
+
+```bash
+TF_VAR_worker_tailscale_enabled=true \
+tofu -chdir=bootstrap/cluster apply \
+  -var-file="$PWD/.lab/cluster-workers.auto.tfvars.json"
+```
+
 Worker Tailscale defaults to `--accept-routes=true` and enables pod egress SNAT
 from the Kubernetes pod CIDR to `tailscale0`, so pods on Pimox workers can reach
 tailnet-only services. Override with
diff --git a/README.md.tmpl b/README.md.tmpl
index 83ab855..e2cd9b9 100644
--- a/README.md.tmpl
+++ b/README.md.tmpl
@@ -196,6 +196,15 @@ ephemeral or pre-authorized auth key outside Git, either in
 LAB_PIMOX_WORKER_TAILSCALE_ENABLED=true ./{{ main_script }} up
 ```
 
+When applying `bootstrap/cluster` directly, use the OpenTofu variable name
+instead of the Jeannie `LAB_` wrapper:
+
+```bash
+TF_VAR_worker_tailscale_enabled=true \
+tofu -chdir=bootstrap/cluster apply \
+  -var-file="$PWD/.lab/cluster-workers.auto.tfvars.json"
+```
+
 Worker Tailscale defaults to `--accept-routes=true` and enables pod egress SNAT
 from the Kubernetes pod CIDR to `tailscale0`, so pods on Pimox workers can reach
 tailnet-only services. Override with