diff --git a/README.md b/README.md
index b2a9ca1..a577537 100644
--- a/README.md
+++ b/README.md
@@ -162,15 +162,15 @@ sources = ["gcal", "holidays"]
 default_sink = "gcal"
 ```
 
-# Authorising Google
+## Authorising Google
 
-Google requires an OAuth client of your own. This is the fiddliest part of the setup, so in full:
+Google requires an OAuth client of your own. This is the fiddliest part of the setup, so in full. Google has also renamed this corner of the console: what older guides call the **OAuth consent screen** is now **Google Auth Platform**, and the old menu entry redirects there.
 
 1. At [console.cloud.google.com](https://console.cloud.google.com), create a
    project — any name.
 2. **APIs & Services → Library**, find **Google Calendar API**, enable it.
-3. **OAuth consent screen**: choose **External**. Fill in the required fields. Under **Test users**, add your own Google address.
-4. **Credentials → Create credentials → OAuth client ID**, and for **Application type** choose **Desktop app**.
+3. **APIs & Services → OAuth consent screen** and choose **External**. On **Branding**, fill in **App name**, **User support email**, and **Email addresses** under **Developer contact information** — the last sits below the fold and is the one usually left blank. On **Audience**, add your own Google address under **Test users**.
+4. **Clients → Create client**, and for **Application type** choose **Desktop app**.
 5. Copy the client ID into `client_id`, and put the client secret somewhere `client_secret_command` can read it:
 
    ```sh
@@ -187,8 +187,24 @@ Google requires an OAuth client of your own. This is the fiddliest part of the s
 
 **One login covers every endpoint on that account.** The authorisation is filed under the account it was granted for, not the endpoint that asked, so a second Google calendar on the same account needs no login of its own. Set `account` on an endpoint only when CalCalist is logged in to more than one account.
 
+## Ending the seven-day expiry
+
 **While the consent screen is in Testing, Google expires refresh tokens after seven days.** An installation that worked last week then stops with nothing
-having changed locally. Publish the consent screen to production to end this; `calcalist doctor` reports it either way.
+having changed locally; `calcalist doctor` names the endpoint when it happens. Moving the app to production ends it — Testing is the only status the rule
+applies to, and verification is not needed.
+
+Production asks for more than Testing did, which is why the **Publish app** button starts out greyed:
+
+1. On **Branding**, **Authorized domains → Add domain** with a domain you own. Add it before the URLs below, which are validated against it.
+2. **Application home page** and **Application privacy policy link**, both URLs on that domain. Google fetches them, so they must be public. [PRIVACY.md](PRIVACY.md) is CalCalist's own, accurate for any installation, and a reasonable starting point for yours.
+3. **Audience → Publish app**. Reload the page first if the button is still greyed; it caches.
+
+A banner then says the app requires verification. It can be ignored. Verification removes the unverified-app warning and the 100-user cap, neither of which
+matters for a client only you use — and it wants a domain review and a demo video in exchange. At the next login the browser shows **"Google hasn't verified
+this app"**: click **Advanced**, then **Go to … (unsafe)**.
+
+**Log in again after publishing.** A refresh token issued while the app was in Testing keeps its seven-day life; publishing does not extend one already
+granted.
 
 ## Getting events to the right calendar