diff --git a/apps/base/consul/README.md b/apps/base/consul/README.md
new file mode 100644
index 0000000..9e2e691
--- /dev/null
+++ b/apps/base/consul/README.md
@@ -0,0 +1,30 @@
+# consul (k8s)
+
+Consul server cluster (DC `au-syd1`), deployed via the HashiCorp helm chart with
+ACLs enabled (`default_policy: deny`, parity with the VM cluster).
+
+## API access (ACL auth)
+
+The HTTP API and UI are served on port 8500 behind the gateway at
+`https://consul.k8s.syd1.au.unkin.net` (and `https://consul.service.consul`).
+With ACLs enabled, requests beyond the anonymous policy require a token:
+
+```bash
+# management (bootstrap) token — seeded from Vault, synced by VSO into the
+# consul-bootstrap-acl-token secret; same value as the VM cluster's
+# initial_management token:
+CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token)
+
+curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader
+
+# consul CLI:
+CONSUL_HTTP_ADDR=https://consul.k8s.syd1.au.unkin.net CONSUL_HTTP_TOKEN=$CONSUL_HTTP_TOKEN consul members
+```
+
+The UI at the same hostname exposes an ACL login (top right) — paste a token.
+Anonymous requests get the anonymous-token policy only (reads for DNS/service
+discovery; no writes, no ACL/token APIs).
+
+Prefer short-lived tokens minted by Vault's consul secrets engine over the
+management token for day-to-day use; the terraform-* CI roles already work this
+way.