diff --git a/docs/07_deployment_and_ops.md b/docs/07_deployment_and_ops.md
index 71876f4..b32ea99 100644
--- a/docs/07_deployment_and_ops.md
+++ b/docs/07_deployment_and_ops.md
@@ -93,7 +93,7 @@ RestartSec=30
 [Install]
 WantedBy=multi-user
 ```
-- **Note:** The full `bitcoind` configuration is in `bitcoin.conf` (or the `contrib/download_and_install_bitcoincore.sh` script). `zmqpubhashblock` and `zmqpubrawblock` must be set to the same address as the `pusher`'s `ZMQ_ENDPOINT`.
+- **Note:** The full `bitcoind` configuration is in `bitcoin.conf` (or the `contrib/download_and_install_bitcoincore.sh` script). The script sets `zmqpubhashblock` (not `zmqpubrawblock`) for the pusher's new-block notifications. The `zmqpubhashblock` and `zmqpubrawtx` ports must be bound to `127.0.0.1` (never `0.0.0.0`) and match the pusher's `ZMQ_ENDPOINT`.
 
 ### `tbitcoind.service` (Systemd Unit for Testnet)
 This is the same as `bitcoind.service` but for the `testnet` network. It uses a different data directory (`~/.bitcoin/testnet/` by default) and a different ZMQ port (e.g., `tcp://127.0.0.1:23332`).
@@ -187,10 +187,10 @@ Before exposing `bal` to the internet, verify the following steps. The `bal-serv
 
 ### 2. Reverse Proxy (Nginx + TLS)
 - [ ] Nginx is installed (`contrib/download_and_install_bal.sh` handles this).
-- [ ] The template `contrib/nginx/bal-server.conf` is copied to `/etc/nginx/sites-available/` and symlinked to `sites-enabled`.
+- [ ] The template `contrib/nginx/bal-server.conf` is copied to `/etc/nginx/sites-available/` and symlinked to `sites-enabled` (the `contrib/download_and_install_bal.sh` script does this automatically).
 - [ ] The file has a real domain name replacing `BAL_DOMAIN`.
 - [ ] `listen 443 ssl http2;` is active.
-- [ ] `certbot` or an equivalent CA has provided a valid certificate.
+- [ ] `certbot --nginx` has obtained a valid certificate (the script runs `certbot --nginx` which avoids the port 80 conflict of `--standalone`). For manual installs, use `sudo certbot --nginx -d $domain`.
 - [ ] `proxy_pass` points to `http://127.0.0.1:9137` (or whatever `BAL_SERVER_BIND_PORT` is).
 - [ ] `client_max_body_size` in Nginx matches `BAL_SERVER_ACTIX_MAX_BODY_SIZE` (default `1m`).
 - [ ] HTTP port 80 redirects to HTTPS (`return 301 https://...`).
diff --git a/docs/09_references_and_links.md b/docs/09_references_and_links.md
index ad05da0..e0f9488 100644
--- a/docs/09_references_and_links.md
+++ b/docs/09_references_and_links.md
@@ -23,7 +23,7 @@
 | Pusher dev script | `bal-pusher.sh` | Sources `bal-pusher.env`, `cargo run` |
 | Send transaction script | `sendtx.sh` | `bitcoin-cli` wrapper |
 | Utility scripts | `lib.sh` | Colored echo functions |
-| Contrib (install) | `contrib/download_and_install_bal.sh` | Nginx, Certbot, systemd setup, hardcoded xpub |
+| Contrib (install) | `contrib/download_and_install_bal.sh` | Nginx, Certbot, systemd setup, xpub via argument |
 | Contrib (install bitcoind) | `contrib/download_and_install_bitcoincore.sh` | Bitcoind download, GPG verify, systemd, config |
 | Contrib (install Tor) | `contrib/install_tor.sh` | Tor repository, `ControlPort 9051` || Systemd service | `bal-server.service` | Runs as `bal` user, `ProtectSystem`, `MemoryDenyWriteExecute` |
 | Systemd service | `bitcoind.service` | `zmqpubhashblock` setup |