diff --git a/.env.example b/.env.example
index e675222..5ee2c2f 100644
--- a/.env.example
+++ b/.env.example
@@ -14,3 +14,8 @@ OPENCODE_API_URL=http://127.0.0.1:5050
 # Optional: password protect the opencode server
 # If set, you must also run: OPENCODE_SERVER_PASSWORD=your-secret opencode serve --port 5050
 # OPENCODE_SERVER_PASSWORD=your-secret
+
+# Optional: restrict bot to a single Telegram user
+# Get your chat ID by messaging @userinfobot on Telegram
+# If not set, the bot responds to anyone
+# TELEGRAM_ALLOWED_CHAT_ID=your_chat_id_here
diff --git a/README.md b/README.md
index 693ab38..974271e 100644
--- a/README.md
+++ b/README.md
@@ -191,6 +191,18 @@ OPENCODE_SERVER_PASSWORD=your-secret
 
 The server only listens on `127.0.0.1` (localhost) by default. It's not accessible from other machines on your network. Never use `--hostname 0.0.0.0` unless you know what you're doing.
 
+### Restrict to your Telegram account (recommended)
+
+By default the bot responds to anyone who finds it. To lock it to your account:
+
+1. Get your chat ID: message [@userinfobot](https://t.me/userinfobot) on Telegram
+2. Add to `.env`:
+```env
+TELEGRAM_ALLOWED_CHAT_ID=your_chat_id_here
+```
+
+Others will receive: "This bot is not authorized to respond to you."
+
 ## Troubleshooting
 
 **"Can't connect to opencode"**