diff --git a/AGENTS.md b/AGENTS.md
index 939d632..dfca111 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -33,6 +33,12 @@ covers install, the token, and usage.
   release. A tag that someone deletes comes back on the next push. To recover a failed build or
   release, run `release.yml` through `workflow_dispatch`.
 
+- `main` requires signed commits, and the bot cannot sign a commit. It also cannot read the rule,
+  so a PR with commits from a plain `git push` shows only `BLOCKED`. Commit through the GraphQL
+  mutation `createCommitOnBranch`, which GitHub signs: stage the change, then run
+  `gh-signed-commit "<headline>" ["<body>"]` from rubas/dotfiles. It also creates the branch on
+  GitHub.
+
 ## Pitfalls
 
 - `flake.nix` repeats the package version as a literal. Bump it in the same commit as