diff --git a/README.md b/README.md
index 60462cf..d2234c1 100644
--- a/README.md
+++ b/README.md
@@ -79,10 +79,15 @@ dns_cloudflare_api_token=abcdefghijklmnopqrstuvwxyz0123456789
 kubectl create secret generic cloudflare-api-token --from-file=cloudflare_api_token.ini -n cloudflare_api_token.ini
 ```
 
+To update the cert 'inline'(ie: if it's been rolled)
+```
+kubectl get secret cloudflare-api-token -o json | jq --arg foo "$(echo -n dns_cloudflare_api_token=$TOKEN | base64 -w 0)" '.data["cloudflare_api_token.ini"]=$foo' | kubectl apply -f -
+```
+
 ## BetterUptime's heartbeat URL (initial setup only)
 
 Get the URL of the heartbeat from BetterUptime so that the cronjob can ping when it successfully renew all the certificates.
 
 ```
 kubectl create secret generic betteruptime-heartbeat --from-literal=url='https://uptime.betterstack.com/api/v1/heartbeat/abcdefghijklmn012345678
-```
\ No newline at end of file
+```