diff --git a/infra/digitalocean/README.md b/infra/digitalocean/README.md
new file mode 100644
index 0000000..e48bb04
--- /dev/null
+++ b/infra/digitalocean/README.md
@@ -0,0 +1,27 @@
+# DigitalOcean Terraform
+
+This Terraform root is intended to run as its own Spacelift stack.
+
+## Spacelift stack
+
+- Project root: `infra/digitalocean`
+- Terraform workflow tool: Terraform
+- Managed state: enabled
+
+Do not configure a backend in this root when using Spacelift-managed state.
+Spacelift injects the backend configuration during runs.
+
+## Required variables
+
+Set these as stack environment variables or attach them through a Spacelift context:
+
+- `TF_VAR_do_token`
+- `TF_VAR_github_app_id`
+- `TF_VAR_github_app_webhook_secret`
+- `TF_VAR_github_app_private_key_base64`
+- `TF_VAR_github_app_client_id`
+- `TF_VAR_github_app_client_secret`
+- `TF_VAR_influxdb_password`
+- `TF_VAR_influxdb_token`
+
+The `setup_credentials` script remains useful for local Terraform runs because it writes `terraform.tfvars` from 1Password.
diff --git a/infra/digitalocean/main.tf b/infra/digitalocean/main.tf
index aeaa470..92f304c 100644
--- a/infra/digitalocean/main.tf
+++ b/infra/digitalocean/main.tf
@@ -5,15 +5,6 @@ terraform {
       version = "~> 2.0"
     }
   }
-
-  cloud {
-    organization = "bpacia"
-
-    workspaces {
-      project = "bee-ci"
-      name    = "bee-ci-workspace"
-    }
-  }
 }
 
 provider "digitalocean" {