diff --git a/Admin-UI.md b/Admin-UI.md
index 7a54300..b7021ed 100644
--- a/Admin-UI.md
+++ b/Admin-UI.md
@@ -30,6 +30,8 @@ weed admin [options]
 | `-dataDir` | "" | Directory to store admin configuration and data files |
 | `-adminUser` | admin | Admin interface username |
 | `-adminPassword` | "" | Admin interface password (if empty, auth is disabled) |
+| `-readOnlyUser` | "" | Read-only user username (optional) |
+| `-readOnlyPassword` | "" | Read-only user password (optional; requires adminPassword) |
 
 ## Examples
 
@@ -85,6 +87,38 @@ The data directory (`-dataDir`) is used to persist admin configuration data:
 - **Disabled by default**: If `-adminPassword` is not set, no authentication is required
 - **Session-based**: When enabled, uses secure session management with auto-generated session keys
 - **User credentials**: Login with `-adminUser` and `-adminPassword`
+- **Read-only access**: Optionally set `-readOnlyUser` and `-readOnlyPassword` for view-only access
+
+### Credentials via Environment Variables / security.toml
+
+Credentials can also be configured via the `[admin]` section in `security.toml` or environment variables, avoiding exposure in CLI flags or process listings.
+
+**security.toml example:**
+```toml
+[admin]
+user = "admin"
+password = "secret"
+
+[admin.readonly]
+user = "viewer"
+password = "viewpass"
+```
+
+**Environment variables** (via viper's `WEED_` prefix):
+
+| security.toml key | Environment Variable |
+|--------------------|----------------------|
+| `admin.user` | `WEED_ADMIN_USER` |
+| `admin.password` | `WEED_ADMIN_PASSWORD` |
+| `admin.readonly.user` | `WEED_ADMIN_READONLY_USER` |
+| `admin.readonly.password` | `WEED_ADMIN_READONLY_PASSWORD` |
+
+**Precedence**: CLI flag > env var / security.toml > default value
+
+```bash
+# Start with credentials from environment variables (adminUser defaults to "admin")
+WEED_ADMIN_PASSWORD=secret weed admin -master=localhost:9333
+```
 
 ### TLS/HTTPS Configuration