diff --git a/CHANGELOG.md b/CHANGELOG.md
index e072dc3..a56ab47 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Light and dark mode, chosen under Appearance in Settings; the default follows
   the system setting.
 - Clicking a service row copies its agents call URL to the clipboard.
+- README section on using Agent Proxy with itkdev-docker's untracked
+  `traefik/dynamic.d/` config directory.
 
 ### Changed
 
diff --git a/README.md b/README.md
index a13a17a..f59397a 100644
--- a/README.md
+++ b/README.md
@@ -148,7 +148,27 @@ providers:
 ```
 
 When Traefik runs in Docker, including Docker Desktop on macOS, point Agent
-Proxy at the host side of the bind mount, not the container path.
+Proxy at the host side of the bind mount, not the container path. Traefik also
+reads subdirectories of the file provider directory, but only reloads on
+changes to files directly in it, so mount the directory Agent Proxy writes to
+as the provider directory itself, not as a subdirectory of it.
+
+### With itkdev-docker
+
+[itkdev-docker](https://github.com/itk-dev/devops_itkdev-docker) mounts the
+untracked `traefik/dynamic.d/` as Traefik's config directory, next to the
+shared `traefik/dynamic-conf.yaml`. Point Agent Proxy at the directory:
+
+```sh
+./agent-proxy -config ~/itkdev-docker/traefik/dynamic.d -traefik http://127.0.0.1:8080
+```
+
+Do not point it at `traefik/dynamic-conf.yaml`. That file is tracked in a public
+repository, so a commit would publish the API keys. To move services already in
+it, add them again in Agent Proxy or move their entries to `dynamic.d/`, then
+restore the shared file with `git checkout -- traefik/dynamic-conf.yaml`. Keep
+each service in one place only: Traefik drops a router or middleware defined
+twice with different content.
 
 ## Usage