diff --git a/README.md b/README.md
index 11864a8..ef569ad 100644
--- a/README.md
+++ b/README.md
@@ -105,6 +105,81 @@ website, follow these instructions:
   validation of the settings, activate authentication via SimpleSAMLphp 
   manually.
 
+
+## Updating from Drupal 9 + simplesamlphp_auth 3 to Drupal 10 + simplesamlphp_auth 4
+
+Drupal 10 has a dependency on Symfony 6. As of this release, the underlying 
+library, `simplesamlphp/simplesamlphp`, does not have a release that is 
+compatible with Symfony 6. The current version of its `master` branch is 
+compatible with Symfony 6, but there is no roadmap for a release; it might be 
+merged into the 2.x branch, but it may not. When Symfony 7 is released in 
+November 2023, there is no guarantee that `simplesamlphp/simplesamlphp` won't 
+simply move on to Symfony 7 compatibility without providing a Symfony 6-compatible 
+release. See https://github.com/simplesamlphp/simplesamlphp/issues/1689
+
+**Therefore, integrating your Drupal site with the `simplesamlphp/simplesamlphp` 
+library at this time is a risk. If you understand the risk, you can install a 
+specific commit hash of the library that is compatible, as explained below.**
+
+These instructions should work for any Composer-based Drupal site. 
+See https://www.drupal.org/docs/develop/using-composer/manage-dependencies#s-create-a-project
+
+If you have been using this module with Drupal 9, updating to Drupal 10 via 
+Composer requires specific syntax, since you will be requiring a 
+"development"-level package. Prior to the update, you will have Composer 
+requirements similar to the following:
+
+```
+"drupal/core-recommended": "^9.5",
+"drupal/simplesamlphp_auth": "^3"
+```
+
+1. Visit https://github.com/simplesamlphp/simplesamlphp and find the hash 
+of the latest commit on the `master` branch (e.g., `2f37266`).
+
+2. Update the requirements in `composer.json` manually to the following, 
+replacing the commit hash for `simplesamlphp` as needed. Using this syntax 
+to target a specific commit is highly recommended, since a ``composer update`` 
+would otherwise update to the latest available commit hash of a branch, and 
+unexpected changes could be introduced.
+
+```
+  "drupal/core-recommended": "^10",
+  "drupal/simplesamlphp_auth": "^4",
+  "simplesamlphp/simplesamlphp": "dev-master#2f37266"
+```
+
+Note: the above syntax assumes a tagged 4.x release. If that is not available, 
+you can retrieve the 4.x branch with `"drupal/simplesamlphp_auth": "dev-4.x"`, 
+with a specific commit hash (e.g., `dev-4.x#666615`)
+
+3. Remove the contents of the `vendor` directory. (This prevents an error with a 
+nonstandard part of the simplesamlphp library, `"Unable to install module` 
+`simplesamlphp/simplesamlphp-assets-base`).
+
+4. In case you haven't already allowed the `simplesamlphp` plugin, run 
+`composer config allow-plugins.simplesamlphp/simplesamlphp true`
+
+5. Run one of the following commands, depending on how narrow or broad the 
+Drupal 10 update needs to be:
+
+- Narrow: `composer update drupal/core-recommended drupal/simplesamlphp_auth simplesamlphp/simplesamlphp -W`
+- Broad: `composer update -W`
+
+Your site should now update to Drupal 10, along with a Drupal 10-compatible 
+version of `simplesamlphp`. If you have other Composer requirements, of course, 
+they could prevent the update.
+
+6. Update the publicly-accessible directory of the simplesamlphp library from 
+`www` to `public`, a change from `simplesamlphp` 1.x to 2.x. Your previous 
+configuration would have used one of multiple ways to define this directory, 
+such as a symlink or a Composer Installers directive. Configuration is out of 
+the scope of the Drupal module. 
+
+See https://simplesamlphp.org/docs/stable/simplesamlphp-install#appendix-installing-simplesamlphp-in-alternative-locations
+
+
+
 # CONFIGURATION
 
 ## Basic configuration