diff --git a/README.md b/README.md
index 021c12e..6d4e62b 100644
--- a/README.md
+++ b/README.md
@@ -92,6 +92,25 @@ Caveats before pulling:
 - Postgres major version bumps (e.g. 17 -> 18) cannot reuse the old data dir -- a plain `compose up -d` will fail to start. See [RUNBOOK.md](RUNBOOK.md#maintenance-postgres-major-version-upgrade).
 - After several updates, reclaim disk with `docker image prune -f`.
 
+**Apps with a local Dockerfile:**
+
+Some compose files build their image locally instead of pulling a tagged one:
+
+| App | Service | Base image | Why |
+|-----|---------|-----------|-----|
+| `nextcloud` | `nextcloud` | `nextcloud:latest` | Adds smbclient + ffmpeg |
+| `minecraft` | `daemon` | `githubyumao/mcsmanager-daemon:latest` | Adds Temurin 25 JRE |
+
+For these, plain `docker compose pull` fails on the buildable service ("pull access denied"). Use one of:
+
+```bash
+docker compose pull --ignore-buildable    # pull only registry-backed services
+docker compose build --pull               # rebuild, refreshing the FROM base
+docker compose up -d --build              # build + pull + recreate, one shot
+```
+
+Diun caveat: Diun watches the running container's image reference. Since these run as local images (e.g. `mcsmanager-daemon-java25`), the registry lookup has nothing to compare against -- **Diun will not notify when the base image updates**. Refresh these manually on your own cadence with `docker compose build --pull && docker compose up -d`.
+
 **Adding a new app:**
 
 1. Create `docker/<app>/compose.yaml` with `container_name` and `shared` network