diff --git a/docs/deployment.md b/docs/deployment.md
index b62064e..7b56514 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -169,9 +169,15 @@ terraform apply -auto-approve -var="dockerhub_image=youruser/open-adapter:latest
 
 This usually means **AWS already has the object** (from an earlier apply) but **Terraform state does not** (first time using S3 backend, or state was lost).
 
-**Option A — Import** existing resources into state (advanced): use `terraform import` with the resource address and AWS id (see Terraform AWS provider docs).
+**Recommended — Clean slate (Option B):** remove the old resources in AWS, then let Terraform create them again and store them in S3 state. Only do this if you do not need to keep the current instance or IP.
 
-**Option B — Clean slate:** in the EC2/VPC console, **delete** the old security group, instance, and Elastic IP *if safe*, then run `terraform apply` again so Terraform creates them and records them in S3 state.
+1. **EC2 → Instances** — select the OpenAdapter instance (tag **Name** `openadapter-production` for the default environment), **Instance state → Terminate instance**, and wait until it is **terminated**.
+2. **EC2 → Elastic IPs** — if an address is still allocated and unused, select it and **Release elastic IP address**.
+3. **EC2 → Security groups** — select **`openadapter-production`**, **Actions → Delete security groups** (only works when nothing is using it).
+
+Then **re-run the CD** workflow (or merge to `main`). Terraform should create a new security group, instance, and EIP and record them in remote state.
+
+**Advanced:** if you must keep existing AWS objects instead of deleting them, use [`terraform import`](https://developer.hashicorp.com/terraform/cli/import) for `aws_security_group.openadapter`, `aws_instance.openadapter`, and `aws_eip.openadapter` with the same S3 backend as CI.
 
 After **S3 backend** is configured and state is aligned, reruns should not duplicate resources.