diff --git a/README.md b/README.md
index 26ad6cb..e490de5 100644
--- a/README.md
+++ b/README.md
@@ -85,6 +85,8 @@ If you skip this step, keep the committed `d1_databases` entry as-is. Wrangler c
 
 If you use Cloudflare Workers Builds with Git integration, set the project Deploy command to `pnpm run deploy` instead of `npx wrangler deploy`. This repository uses a pnpm workspace, so `pnpm deploy` runs pnpm's built-in workspace deploy command rather than the package script. `pnpm run deploy` is the form that runs this repository's plain `wrangler deploy` script.
 
+If you already have an existing D1 database that your own Worker must keep using, set the `DDNS_D1_DATABASE_ID` environment variable in your local shell or in Workers Builds. The deploy script will generate a temporary `.wrangler/deploy/wrangler.generated.jsonc` file containing that real `database_id` only for the current deploy. The committed template config remains unchanged.
+
 ### 3. Set secrets
 
 ```sh
@@ -127,7 +129,9 @@ This runs a standard `wrangler deploy`.
 
 For this repository's default template path, the Worker deploys without requiring a pre-existing D1 `database_id`. DDNS updates still work before the audit-log table exists, but D1-backed audit logging only becomes active after you apply the SQL migrations from a local/operator workflow.
 
-Workers Builds does not need a dedicated D1 build secret for this repository. Use the committed D1 binding and set the Deploy command to `pnpm run deploy`.
+Workers Builds does not need a dedicated D1 build secret for this repository when you want the template-safe default path. Use the committed D1 binding and set the Deploy command to `pnpm run deploy`.
+
+If you are deploying your own long-lived Worker and want it to keep the same existing D1 database, add `DDNS_D1_DATABASE_ID=<your-existing-database-uuid>` to the Workers Builds environment variables. `pnpm run deploy` will then inject that `database_id` into a generated deploy-only Wrangler config before running `wrangler deploy`.
 
 If you want to manage the D1 database explicitly after cloning locally, run:
 
@@ -138,7 +142,16 @@ pnpm run migrate:remote
 pnpm run deploy
 ```
 
-That path writes a real `database_id` into your local `wrangler.jsonc`, uploads the required secrets, applies the SQL migrations remotely, and then deploys the Worker. It is the recommended way to enable the D1-backed audit log.
+That path writes a real `database_id` into your local `wrangler.jsonc`, uploads the required secrets, applies the SQL migrations remotely, and then deploys the Worker. It is the recommended way to enable the D1-backed audit log from a local/operator workflow.
+
+If you want the same behavior in CI or Workers Builds without committing the ID, set `DDNS_D1_DATABASE_ID` and then use:
+
+```sh
+pnpm run migrate:remote
+pnpm run deploy
+```
+
+`pnpm run migrate:remote` requires `DDNS_D1_DATABASE_ID` because remote D1 operations need the real database UUID.
 
 ## Environment variables