diff --git a/README.md b/README.md
index 57491e6..801ce46 100644
--- a/README.md
+++ b/README.md
@@ -478,3 +478,64 @@ Manual triggers available via admin endpoints: `triggerEventNotifications()`, `t
 ## Audit Logging
 
 All write operations log to `auditLogs` via the `auditContext` pattern. Services receive `{ userId, ipAddress, userAgent }` and call the audit service internally. Tracked: logins, logouts, password changes, CRUD on companies/projects/todos/notes/timesheets, user assignments, admin actions.
+
+---
+
+## PDF Certificate Generation
+
+The AI Kurzy module can generate PDF certificates for course participants using Puppeteer.
+
+**Services:**
+- `certificate.service.js` — `generateCertificate(registraciaId, templateName)`, `getCertificateDownloadInfo(prilohaId)`, `getAvailableTemplates()`, `hasCertificate(registraciaId)`
+- `certificate-email.service.js` — `sendCertificateEmail(registraciaId, prilohaId)` — sends certificate via JMAP
+
+**Available Templates:**
+- `AIcertifikat` — AI kurz (Zdarílek + Gablasová)
+- `AIcertifikatGablas` — AI kurz (Gablas + Gablasová)
+- `AIcertifikatPatrik` — AI kurz (Patrik + Gablasová)
+- `ScrumMaster`, `ScrumProductOwner` — Scrum certifications
+- `ITILFoundation` — ITIL® 4 Foundation
+- `PRINCE2Foundation`, `PRINCE2Practitioner` — PRINCE2® certifications
+
+---
+
+## Docker Deployment
+
+```dockerfile
+FROM node:20-alpine
+
+WORKDIR /app
+
+COPY package*.json ./
+RUN npm ci --only=production
+
+# Required for PDF certificate generation
+RUN apk add --no-cache chromium
+ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
+ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
+
+COPY src ./src
+COPY drizzle.config.js ./
+
+RUN mkdir -p uploads
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nodejs -u 1001 && \
+    chown -R nodejs:nodejs /app
+
+USER nodejs
+EXPOSE 5000
+CMD ["node", "src/index.js"]
+```
+
+**Environment Variables:**
+```env
+NODE_ENV=production
+DATABASE_URL=postgres://user:pass@host:5432/db
+JWT_SECRET=your-secret
+JWT_REFRESH_SECRET=your-refresh-secret
+ENCRYPTION_KEY=32-char-key-for-aes
+JMAP_URL=https://mail.truemail.sk/jmap/
+VAPID_PUBLIC_KEY=...
+VAPID_PRIVATE_KEY=...
+CORS_ORIGIN=https://your-frontend.com
+```