diff --git a/defaults/vpn/README.md b/defaults/vpn/README.md
index 479a565..d31282a 100644
--- a/defaults/vpn/README.md
+++ b/defaults/vpn/README.md
@@ -23,9 +23,12 @@ Currently, name resolution for these do not work reliably on first starts, hence
 To register a new client, you can generate a pre-auth key and insert it in the client:
 
 ```bash
+headscale users create marlene.mayer
 headscale preauthkeys create --user marlene.mayer
 ```
 
+**Note**: The username must be added (or match an existing entry) in `qois.vpn-server.wheelUsers`.
+
 Or alternatively use the register command shown when configuring the VPN client.
 
 ## ACL