diff --git a/kustomize/README.md b/kustomize/README.md
index 49083dce..26de89cd 100644
--- a/kustomize/README.md
+++ b/kustomize/README.md
@@ -745,6 +745,7 @@ oc set env deployment/exploit-iq-client -n $YOUR_NAMESPACE_NAME \
   QUARKUS_OIDC_AUTHENTICATION_REDIRECT_PATH=/ \
   QUARKUS_SECURITY_JAXRS_DENY_UNANNOTATED_ENDPOINTS=false \
   EXPLOITIQ_SECURITY_OIDC_SCOPE_ROLE_MAPPINGS='exploitiq-resource-server/exploitiq-api-access=exploitiq-api-access' \
+  EXPLOITIQ_SECURITY_PUBLIC_LOGOUT_PATHS=/logout,/api/v1/user/logged-out \
   COGNITO_DOMAIN="${COGNITO_DOMAIN}"
 ```
 
@@ -757,6 +758,7 @@ oc set env deployment/exploit-iq-client -n $YOUR_NAMESPACE_NAME \
 | `COGNITO_DOMAIN` | User Pool → **App integration** → **Domain** (must include `https://` prefix) |
 | `UI_CLIENT_ID` | **UI App Client** → Client ID |
 | `UI_CLIENT_SECRET` | **UI App Client** → Client secret |
+| `EXPLOITIQ_SECURITY_PUBLIC_LOGOUT_PATHS` | Comma-separated list of public logout paths. For Cognito, must include `/logout,/api/v1/user/logged-out` |
 
 
 #### Update Cognito Callback URL