diff --git a/examples/codex_runtime_on_agentkit/README.md b/examples/codex_runtime_on_agentkit/README.md
index 527763c1..5d76a641 100644
--- a/examples/codex_runtime_on_agentkit/README.md
+++ b/examples/codex_runtime_on_agentkit/README.md
@@ -56,17 +56,40 @@ the bundled Codex binary spawns.
 
 ## 3. Deploy to AgentKit
 
+`agentkit config` writes `agentkit.yaml`; `agentkit launch` then builds and
+deploys from it. The model config (`MODEL_AGENT_*`) is read from the `.env`
+from step 1, which is bundled into the image, so it need not go in
+`--runtime_envs`. A minimal config:
+
 ```bash
-# fill in account-specific fields in agentkit.yaml (interactive)
-veadk agentkit config
+veadk agentkit config \
+  --agent_name codex-runtime-demo --entry_point app.py \
+  --language Python --language_version 3.12 \
+  --launch_type cloud --region cn-beijing \
+  --tos_bucket Auto \
+  --runtime_name codex-runtime-demo --runtime_apikey_name Auto \
+  --runtime_envs OTEL_SDK_DISABLED=true
+
+veadk agentkit launch                       # build + deploy in one step
+veadk agentkit status                       # wait until Ready
+veadk agentkit invoke "你好，你叫什么"      # test it
+```
 
-# build the image and deploy in one step
-veadk agentkit launch
+**Required** — set these:
 
-# check status / send a test request once it's live
-veadk agentkit status
-veadk agentkit invoke "你好，你叫什么"
-```
+- `--agent_name`, `--entry_point app.py`, `--launch_type cloud`, `--region`.
+- `--language` / `--language_version`.
+- `--tos_bucket Auto` — without `Auto`, the upload fails the bucket-ownership
+  (`ListBuckets`) check unless your AK/SK has `tos:ListBuckets`.
+- `--runtime_name` / `--runtime_apikey_name Auto`.
+
+**Optional** — omit and AgentKit handles it:
+
+- `--runtime_role_name` — auto-selected/created if omitted.
+- `MODEL_AGENT_*` — read from the bundled `.env`, so not needed in
+  `--runtime_envs` (`OTEL_SDK_DISABLED=true` is worth passing to silence OTel).
+- Auth type — defaults to **API Key**; `custom_jwt` also needs a JWT discovery
+  URL and client IDs.
 
 `veadk agentkit launch` = `build` + `deploy`. Use `veadk agentkit destroy` to
 tear the runtime down.
diff --git a/examples/codex_runtime_on_agentkit/README.zh.md b/examples/codex_runtime_on_agentkit/README.zh.md
index bf85071e..c8dc6564 100644
--- a/examples/codex_runtime_on_agentkit/README.zh.md
+++ b/examples/codex_runtime_on_agentkit/README.zh.md
@@ -52,17 +52,39 @@ python app.py            # 或：python -m app
 
 ## 3. 部署到 AgentKit
 
+`agentkit config` 写出 `agentkit.yaml`，`agentkit launch` 再据此构建并部署。模型
+配置（`MODEL_AGENT_*`）从第 1 步的 `.env` 读取（它会被打包进镜像），所以**不必**
+再写进 `--runtime_envs`。最小配置：
+
 ```bash
-# 交互式填写 agentkit.yaml 中与账号相关的字段
-veadk agentkit config
+veadk agentkit config \
+  --agent_name codex-runtime-demo --entry_point app.py \
+  --language Python --language_version 3.12 \
+  --launch_type cloud --region cn-beijing \
+  --tos_bucket Auto \
+  --runtime_name codex-runtime-demo --runtime_apikey_name Auto \
+  --runtime_envs OTEL_SDK_DISABLED=true
+
+veadk agentkit launch                       # 一步完成构建 + 部署
+veadk agentkit status                       # 等到 Ready
+veadk agentkit invoke "你好，你叫什么"      # 测试
+```
 
-# 一步完成镜像构建与部署
-veadk agentkit launch
+**必填**（要设置）：
 
-# 上线后查看状态 / 发测试请求
-veadk agentkit status
-veadk agentkit invoke "你好，你叫什么"
-```
+- `--agent_name`、`--entry_point app.py`、`--launch_type cloud`、`--region`。
+- `--language` / `--language_version`。
+- `--tos_bucket Auto` —— 不设 `Auto` 的话，上传会卡在 bucket 所有权
+  （`ListBuckets`）校验，除非你的 AK/SK 有 `tos:ListBuckets` 权限。
+- `--runtime_name` / `--runtime_apikey_name Auto`。
+
+**可选**（不填由 AgentKit 自动处理）：
+
+- `--runtime_role_name` —— 不填会自动选/建。
+- `MODEL_AGENT_*` —— 从打包进镜像的 `.env` 读取，不必写进 `--runtime_envs`
+  （`OTEL_SDK_DISABLED=true` 建议带上，避免 OTel 连接报错）。
+- 鉴权方式 —— 默认 **API Key**；`custom_jwt` 还要额外配 JWT discovery URL 和
+  client ID。
 
 `veadk agentkit launch` = `build` + `deploy`。用 `veadk agentkit destroy` 拆除。