diff --git a/IMMICH-MIGRATION.md b/IMMICH-MIGRATION.md
index 2962cf9..eec5c13 100644
--- a/IMMICH-MIGRATION.md
+++ b/IMMICH-MIGRATION.md
@@ -4,8 +4,8 @@ One-time migration of photos from Nextcloud into Immich's native library.
 
 - **Source:** `/opt/argento/docker/nextcloud/data/timothykim/files/Photos/` (338 GB, ~58k files)
 - **Target:** Immich native library on `threeteras` pool (`/opt/argento/docker/immich/library/`)
-- **Tool:** `immich-go` via Immich HTTP API
-- **Expected wall time:** ~1 day if videos are short clips, 2–3 days if significant long/4K video
+- **Tool:** official `immich-cli` via Immich HTTP API
+- **Expected wall time:** ~1 day if videos are short clips, 2-3 days if significant long/4K video
 
 ## 1. Pause the backup cron (optional but recommended)
 
@@ -15,55 +15,59 @@ crontab -e   # comment out scripts/backup.sh line
 
 Re-enable after migration completes.
 
-## 2. Install immich-go
-
-```bash
-mkdir -p /opt/argento/tools && cd /opt/argento/tools
-wget https://github.com/simulot/immich-go/releases/latest/download/immich-go_Linux_x86_64.tar.gz
-tar xzf immich-go_Linux_x86_64.tar.gz
-./immich-go --version
-```
-
-## 3. Get an Immich API key
+## 2. Get an Immich API key
 
 Immich UI -> Account Settings -> API Keys -> New (label it "migration"). Save the key.
 
-## 4. Get the direct container IP (skips nginx/TLS overhead)
+## 3. Get the direct container IP (skips nginx/TLS overhead)
 
 ```bash
 IMMICH_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' immich_server | awk '{print $1}')
 echo $IMMICH_IP
 ```
 
-## 5. Dry-run on a small subfolder first
+## 4. Dry-run on a small subfolder first
 
-Pick one year or album:
+Pick one year or album. The CLI runs inside a container with the source bind-mounted read-only:
 
 ```bash
-./immich-go upload from-folder \
-  --server http://$IMMICH_IP:2283 \
-  --api-key <KEY> \
-  --dry-run \
-  /opt/argento/docker/nextcloud/data/timothykim/files/Photos/<small-subfolder>
+docker run -it --rm \
+  -v /opt/argento/docker/nextcloud/data/timothykim/files/Photos/<small-subfolder>:/import:ro \
+  ghcr.io/immich-app/immich-cli:latest \
+  upload --server http://$IMMICH_IP:2283/api --key <KEY> --dry-run --recursive /import
 ```
 
-## 6. Real run on that subfolder, verify in UI
+## 5. Real run on that subfolder, verify in UI
 
-Drop `--dry-run`, run, then in Immich check: dates, GPS, thumbnails, album assignment look correct.
+Drop `--dry-run`, run, then in Immich check: dates, GPS, thumbnails look correct.
 
-## 7. Full migration in tmux
+## 6. Full migration in tmux
 
 ```bash
 tmux new -s immich-migrate
-./immich-go upload from-folder \
-  --server http://$IMMICH_IP:2283 \
-  --api-key <KEY> \
-  --into-album-folder \
-  /opt/argento/docker/nextcloud/data/timothykim/files/Photos/
+
+docker run -it --rm \
+  -v /opt/argento/docker/nextcloud/data/timothykim/files/Photos:/import:ro \
+  ghcr.io/immich-app/immich-cli:latest \
+  upload --server http://$IMMICH_IP:2283/api --key <KEY> --recursive -c 4 /import
+
 # Ctrl-b d to detach; tmux attach -t immich-migrate to resume
 ```
 
-Safe to Ctrl-C and re-run -- idempotent by file hash.
+Notes:
+- No `--album` flag -- photos land in the main timeline, organized by date.
+- `-c 4` is the default concurrency. Raise carefully; Immich's ingest + ML post-processing can saturate CPU/RAM.
+- Safe to Ctrl-C and re-run -- the CLI hashes files client-side and skips anything already uploaded.
+
+## 7. Watch resources during upload
+
+In another terminal:
+
+```bash
+docker stats immich_server immich_postgres immich_machine_learning
+```
+
+If memory pressure gets bad, lower `-c` on the next restart.
 
 ## 8. Wait for background jobs
 
@@ -82,7 +86,7 @@ find /opt/argento/docker/nextcloud/data/timothykim/files/Photos/ -type f | wc -l
 # Compare to Immich UI -> Administration -> Server Stats
 ```
 
-If mismatch, re-run step 7 (will only upload the missing files).
+If mismatch, re-run step 6 (will only upload the missing files).
 
 ## 10. Spot-check the library