diff --git a/applet/INSTALL.md b/applet/INSTALL.md
index e3fbb37..6643680 100644
--- a/applet/INSTALL.md
+++ b/applet/INSTALL.md
@@ -193,6 +193,30 @@ step the real firmware will eventually run — so a green bench-test is
 strong evidence the applet is correct independently of any future
 reader implementation.
 
+### Step-Up M2 verification (`--step-up`)
+
+```
+aliro-bench-test --trust-dir ~/aliro-trust --step-up
+```
+
+Adds the Step-Up phase on top of the EXPEDITED verdict: SELECT-STEPUP
+(ACCE5502) derives session keys from the cached `StepUpSK`, EXCHANGE
++ ENVELOPE + chained GET RESPONSE drive a real mdoc DeviceRequest to
+the card and pull the encrypted DeviceResponse back. The harness
+decrypts under `StepUpSKDevice` and asserts the embedded Access
+Document round-trips byte-for-byte against the personalized blob.
+
+Successful output appends:
+
+```
+STEP-UP M2: OK — Access Document round-trip verified, 272 bytes match
+```
+
+A `STEP-UP M2: FAIL` line means one of: SELECT-STEPUP didn't arm
+(no preceding AUTH1), GCM tag mismatch (key/counter divergence), or
+the recovered AD bytes don't match. The Expedited block above still
+needs to be `OK` for any of this to run.
+
 ## Uninstall / re-install
 
 `gp --delete <pkg_AID>` won't succeed while applet *instances* still