diff --git a/README.md b/README.md
index 8504dd2..cdea469 100644
--- a/README.md
+++ b/README.md
@@ -37,4 +37,6 @@ The `latest` tag will automatically point to the latest build.
 
 These images are signed with sisgstore's [cosign](https://docs.sigstore.dev/cosign/overview/). You can verify the signature by downloading the `cosign.pub` key from this repo and running the following command:
 
-    cosign verify --key cosign.pub ghcr.io/ublue-os/base
\ No newline at end of file
+    cosign verify --key cosign.pub ghcr.io/ublue-os/base
+    
+If you're forking this repo you should [read the docs](https://docs.github.com/en/actions/security-guides/encrypted-secrets) on keeping secrets in github. You need to [generate a new keypair](https://docs.sigstore.dev/cosign/overview/) with cosign. The public key can be in your public repo (your users need it to check the signatures), and you can paste the private key in Settings -> Secrets -> Actions.