diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 312d9ef..6ce07a3 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -86,3 +86,18 @@ We follow [Conventional Commits](https://www.conventionalcommits.org/):
 
 [optional footer]
 ```
+
+## Signed Commits
+
+Every commit that reaches the default branch must be signed; a ruleset refuses
+unsigned pushes. Estate policy:
+[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc).
+
+- **People and interactive agents** sign with an SSH key registered on GitHub
+  as a *signing* key (`gpg.format=ssh`, `commit.gpgsign=true`). The committer
+  email must be verified on that account.
+- **Apps, bots and workflows** never `git push` local commits. They write
+  through the API (`createCommitOnBranch`, the estate `signed-push` action, or a
+  squash merge) so that GitHub signs the commit.
+- Merge PRs with **squash**. Rebase-merge replays commits unsigned and is
+  disabled.