diff --git a/README.md b/README.md
index 899aec7..9fe5461 100644
--- a/README.md
+++ b/README.md
@@ -62,3 +62,10 @@ DNS-записи должны вести на внешний IP NAS. В Synology
 - `auth.dcserve.ru` -> `http://172.22.0.222:9919`
 
 Оба target-порта ведут в один Caddy контейнер внутри compose-проекта `dc-cms`; Caddy разводит запросы по Host.
+
+Bootstrap Authentik on Synology:
+
+```bash
+cd /volume1/docker/dc-cms/source/infra
+sudo /usr/local/bin/docker compose --env-file .env.synology -f docker-compose.yml exec -T authentik-worker sh -lc 'if command -v ak >/dev/null 2>&1; then ak shell < /bootstrap/bootstrap-cms.py; else /lifecycle/ak shell < /bootstrap/bootstrap-cms.py; fi'
+```
diff --git a/infra/scripts/bootstrap-authentik.sh b/infra/scripts/bootstrap-authentik.sh
index e7612d9..a2c3c5e 100755
--- a/infra/scripts/bootstrap-authentik.sh
+++ b/infra/scripts/bootstrap-authentik.sh
@@ -6,4 +6,5 @@ INFRA_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
 cd "${INFRA_DIR}"
 
-docker compose --env-file .env -f docker-compose.yml exec -T authentik-worker python /bootstrap/bootstrap-cms.py
+docker compose --env-file "${CMS_ENV_FILE:-.env}" -f docker-compose.yml exec -T authentik-worker sh -lc \
+  'if command -v ak >/dev/null 2>&1; then ak shell < /bootstrap/bootstrap-cms.py; else /lifecycle/ak shell < /bootstrap/bootstrap-cms.py; fi'