diff --git a/doc/supported-devices.md b/doc/supported-devices.md
index 17d5497..1be8dc9 100644
--- a/doc/supported-devices.md
+++ b/doc/supported-devices.md
@@ -4,7 +4,12 @@ Rayhunter was built and tested primarily on the Orbic RC400L mobile hotspot, but
 
 If you have a device in mind which you'd like Rayhunter to support, please [open a discussion on our Github](https://github.com/EFForg/rayhunter/discussions)!
 
+## Tier 1 - Fully supported devices
+These devices have been extensively tested by the core developers and are widely used. We recommend running Rayhunter on one of these devices if you can.
 - [Orbic RC400L](./orbic.md)
 - [TP-Link M7350](./tplink-m7350.md)
 - [TP-Link M7310](./tplink-m7310.md)
+
+## Tier 2 - Functional devices
+Some developers have succeeded in getting Rayhunter running on these devices, but they have not received the same level of adoption as tier 1 devices.
 - [Wingtech CT2MHS01](./wingtech-ct2mhs01.md)
diff --git a/doc/wingtech-ct2mhs01.md b/doc/wingtech-ct2mhs01.md
index 922572d..5ad9ca4 100644
--- a/doc/wingtech-ct2mhs01.md
+++ b/doc/wingtech-ct2mhs01.md
@@ -1,5 +1,7 @@
 # Wingtech CT2MHS01
 
+Supported in Rayhunter since version 0.4.0.
+
 The Wingtech CT2MHS01 hotspot is a Qualcomm mdm9650-based device with a screen available for US$15-35. This device is often used as a base platform for white labeled versions like the T-Mobile TMOHS1. AT&T branded versions of the hotspot seem to be the most abundant.
 
 ## Hardware
@@ -23,7 +25,7 @@ Please consider sharing the contents of your device's /etc/wt_version file here.
 
 There are likely variants of the device for all three ITU regions.
 
-According to FCC ID 2APXW-CT2MHS01 Test Report No. I20N02441-RF-LTE, the ITU Region 2 American version of the device supports the following LTE bands:
+According to FCC ID 2APXW-CT2MHS01 Test Report No. [I20N02441-RF-LTE](https://apps.fcc.gov/eas/GetApplicationAttachment.html?id=4957451), the ITU Region 2 American version of the device supports the following LTE bands:
 
 | Band | Frequency        |
 | ---- | ---------------- |
@@ -36,6 +38,28 @@ According to FCC ID 2APXW-CT2MHS01 Test Report No. I20N02441-RF-LTE, the ITU Reg
 
 Note that Band 5 (850 MHz, CLR) is suitable for roaming in ITU regions 2 and 3.
 
+## Installing
+Connect to the Wingtech's network over wifi or usb tethering, then run the installer:
+
+```sh
+./installer wingtech --admin-password 12345678  # replace with your own password
+```
+
+## Obtaining a shell
+Even when rayhunter is running, for security reasons the Wingtech will not have telnet or adb enabled during normal operation.
+
+Use either command below to enable telnet or adb access:
+
+```sh
+./install util wingtech-start-telnet --admin-password 12345678
+telnet 192.168.1.1
+```
+
+```sh
+./install util wingtech-start-adb --admin-password 12345678
+adb shell
+```
+
 ## Developing
 The device has a framebuffer-driven screen at /dev/fb0 that behaves
 similarly to the Orbic RC400L, although the userspace program