diff --git a/readme b/readme
--- a/readme
+++ b/readme
@@ -46,3 +46,21 @@ I1212 18:37:55.561255       1 service.go
 I1212 18:37:55.562467       1 ingress.go:99] cert-manager/challenges/http01/selfCheck/http01/ensureIngress "msg"="found one existing HTTP01 solver ingress" "dnsName"="authenticate.bigasterisk.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-skn9b" "related_resource_namespace"="pomerium" "related_resource_version"="v1" "resource_kind"="Challenge" "resource_name"="pomerium-proxy-tls-5hmnq-2918954797-1564766882" "resource_namespace"="pomerium" "resource_version"="v1" "type"="HTTP-01"
 
 E1212 18:37:55.604107       1 sync.go:190] cert-manager/challenges "msg"="propagation check failed" "error"="failed to perform self check GET request 'http://authenticate.bigasterisk.com/.well-known/acme-challenge/40xNPGvj7rFgf1PSlm4UKmQw6i9BJsMe8orpIFXrxAc': Get \"http://authenticate.bigasterisk.com/.well-known/acme-challenge/40xNPGvj7rFgf1PSlm4UKmQw6i9BJsMe8orpIFXrxAc\": EOF" "dnsName"="authenticate.bigasterisk.com" "resource_kind"="Challenge" "resource_name"="pomerium-proxy-tls-5hmnq-2918954797-1564766882" "resource_namespace"="pomerium" "resource_version"="v1" "type"="HTTP-01"
+
+
+------------------------------
+# version notes
+
+        # see https://hub.docker.com/r/pomerium/ingress-controller/tags but idk how to get the version number!
+        # It's not even in the startup logs, just this: "pomerium_version":""
+        #
+        # I think sha-2c8038a is v0.21.3 (by date, https://www.pomerium.com/docs/releases/changelog)
+        #
+        # sha-dd49d67 is 2023-05-30,
+        # https://github.com/pomerium/ingress-controller/commit/dd49d679ea077930229dff8aa319c58c77a767dc
+        # including 'current main branch' as of 2023-05-23 per
+        # https://github.com/pomerium/ingress-controller/commit/f79735129577344cc9fd766ff1b51df324990771
+        image: pomerium/ingress-controller:sha-dd49d67
+
+preview kustomize:
+meld =(cat 00-defs/00-namespace.yaml 00-defs/01-crd.yaml 00-defs/02-roles.yaml 20-kube/21-pom-svc.yaml 20-kube/20-pom-deploy.yaml) =(k kustomize -o /dev/stdout)