diff --git a/ops/chart/README.md b/ops/chart/README.md
new file mode 100644
index 0000000..52e6f1a
--- /dev/null
+++ b/ops/chart/README.md
@@ -0,0 +1,9 @@
+# Helm chart for Metaforecast
+
+## Notes
+
+The `image.tag` is updated automatically by the CI GitHub Action on each commit.
+
+The secret with the name matching the `envSecret` value, containing environment variables, should be created in the target Kubernetes cluster. See `env.example` at the root of the repository for the required variables.
+
+Elasticsearch is not deployed by default; you need to set up your own instance and provide its credentials in the secret. If you want to self-host Elastic in Kubernetes, you'll need to set up [ECK](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html) (that's what we do at QURI) or some other configuration.
diff --git a/ops/chart/templates/jobs.yaml b/ops/chart/templates/jobs.yaml
index bcfa783..cfc75e1 100644
--- a/ops/chart/templates/jobs.yaml
+++ b/ops/chart/templates/jobs.yaml
@@ -13,8 +13,6 @@ spec:
       template:
         spec:
           restartPolicy: Never
-          imagePullSecrets:
-          - name: {{ required "image.pullSecret is required" $.Values.image.pullSecret }}
           containers:
           - name: cronjob
             image: "{{ required "image.name is required" $.Values.image.name }}:{{ required "image.tag is required" $.Values.image.tag }}"
diff --git a/ops/chart/values.yaml b/ops/chart/values.yaml
index fec290e..108a790 100644
--- a/ops/chart/values.yaml
+++ b/ops/chart/values.yaml
@@ -1,5 +1,6 @@
 image:
   name: ghcr.io/quantified-uncertainty/metaforecast
+  # do not edit; this tag will be updated by the CI GitHub Action on each commit
   tag: sha-7d7683102c5274aab515ffb195f5fbcb647b95b9
 
 # Secret; you should create this in your k8s cluster.