diff --git a/plan/05-minecraft.md b/plan/05-minecraft.md
index be2f796..69c5f04 100644
--- a/plan/05-minecraft.md
+++ b/plan/05-minecraft.md
@@ -35,6 +35,30 @@ authlib URL uses the `auth` subdomain; resolves internally via the caddy alias.
 Memory: `INIT_MEMORY 4G`, `MAX_MEMORY 10G`, `USE_AIKAR_FLAGS TRUE`.
 RCON enabled for mc-backup.
 
+## Server operators (OP)
+
+**Do NOT use the itzg `OPS` env var.** It resolves usernames to UUIDs via a
+Mojang lookup, but this server is `ONLINE_MODE=FALSE` with Drasl auth — Drasl
+assigns its own UUIDs (not Mojang, not the offline-hash). A Mojang-resolved UUID
+would not match the player's real session UUID, so the op entry would be inert
+(and could clobber a correct `ops.json` on reboot).
+
+**Op via RCON instead.** The player must have connected at least once so their
+real Drasl UUID is cached in `/data/usercache.json`; then `op <name>` writes that
+cached UUID to `ops.json`. On the host:
+
+```
+ssh cochi
+docker exec minecraft rcon-cli list                 # confirm cache / who's on
+docker exec minecraft sh -c 'cat /data/usercache.json'   # verify name→UUID cached
+docker exec minecraft rcon-cli op <name>
+docker exec minecraft sh -c 'cat /data/ops.json'    # verify level 4 + right UUID
+```
+
+`ops.json` lives in the `mc_data` volume → persists across restarts; no reboot
+needed (takes effect live). Current op: `oier`
+(`7fbc9adb-bcf4-3913-9a99-46d46acd1009`), level 4, set 2026-06-21.
+
 ## Tasks
 
 - [ ] Compose: authlib URL `http://auth.${BASE_DOMAIN}/authlib-injector`