diff --git a/README.md b/README.md
index f09e1a0..3ee4b6d 100644
--- a/README.md
+++ b/README.md
@@ -89,6 +89,10 @@ Or manage in-game via RCON:
 docker compose exec mc rcon-cli
 ```
 
+### 6. (Optional) Set up Bedrock access
+
+See the [playit.gg Tunnel Setup](./docs/playit.md#bedrock-geyser-tunnel) doc for Bedrock tunnel configuration and account-linking instructions.
+
 ## Scripts
 
 Utility scripts live in `scripts/`.
diff --git a/docs/getting-started.md b/docs/getting-started.md
index d73b843..1f76336 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -64,7 +64,11 @@ docker compose up -d playit
 
 Your server address is shown in the playit dashboard. Share it with whitelisted players.
 
-### 6. (Optional) Run the setup script
+### 6. (Optional) Set up Bedrock access
+
+See the [playit.gg Tunnel Setup](./docs/playit.md#bedrock-geyser-tunnel) doc for Bedrock tunnel configuration and account-linking instructions.
+
+### 7. (Optional) Run the setup script
 
 For a guided setup including optimisation prompts, neofetch installation, and alias configuration:
 
diff --git a/docs/playit.md b/docs/playit.md
index 5dec947..7cf0e5f 100644
--- a/docs/playit.md
+++ b/docs/playit.md
@@ -84,3 +84,14 @@ meeting-hidden.gl.at.ply.gg:61768
 ```
 
 Bedrock players connect with this address. `broadcast-port` in Geyser's `config.yml` should be set to `61768` to match. If the tunnel is ever recreated, the address changes and this needs updating.
+
+### Linking accounts
+
+Because the server uses a whitelist (Java UUIDs), Bedrock players must link their Bedrock and Java accounts so Floodgate can authorise them.
+
+1. Have the player join the server once via **Java Edition** (their Java UUID must be in `MC_WHITELIST`).
+2. In-game, run `/linkaccount` — a linking code is printed in chat.
+3. Have them join again, this time via **Bedrock Edition**, and run `/linkaccount <code>`.
+4. Done. Floodgate remembers the link and lets them in on future Bedrock connections.
+
+Bedrock players appear with a `.` prefix on their username (e.g. `.Steve`) to avoid name collisions with Java players.