diff --git a/README.md b/README.md
index a590bfe8c6..29f5713bf2 100644
--- a/README.md
+++ b/README.md
@@ -170,6 +170,7 @@ and Recovery desktop history-table layout are all aligned.
 - **[Multi-Tenant](docs/MULTI_TENANT.md)**: Enterprise/internal multi-organization setup and configuration.
 - **[Troubleshooting](docs/TROUBLESHOOTING.md)**: Solutions to common issues.
 - **[Agent Security](docs/AGENT_SECURITY.md)**: Agent privilege model, Proxmox API-only choices, and checksum/signature verification.
+- **[Code Signing Policy](docs/CODE_SIGNING_POLICY.md)**: Build provenance, signing scope, approvals, and Windows publisher trust.
 - **[Docker Monitoring](docs/DOCKER.md)**: Setup and management of Docker agents.
 
 ## 🌐 Community Integrations
diff --git a/docs/CODE_SIGNING_POLICY.md b/docs/CODE_SIGNING_POLICY.md
new file mode 100644
index 0000000000..28e28d87d5
--- /dev/null
+++ b/docs/CODE_SIGNING_POLICY.md
@@ -0,0 +1,55 @@
+# Code Signing Policy
+
+Pulse publishes release artifacts from the public
+[`rcourtman/Pulse`](https://github.com/rcourtman/Pulse) repository. This policy
+applies only to the open-source community artifacts built from that repository.
+Private Pulse Pro, Relay, Enterprise, and service infrastructure are outside the
+scope of the SignPath Foundation application and must not be submitted to the
+community signing project.
+
+## Signing service
+
+Pulse is applying to the SignPath Foundation open-source programme. Once the
+application is approved, Windows community release artifacts will use free code
+signing provided by [SignPath.io](https://signpath.io/), with the certificate
+issued by the [SignPath Foundation](https://signpath.org/).
+
+Until approval and production integration are complete, release notes must say
+when a Windows artifact is not Authenticode-signed. Detached checksums and Pulse
+release signatures remain mandatory and are not a substitute for Authenticode.
+
+## Build and release controls
+
+- Release artifacts are built by GitHub Actions from an exact commit on the
+  protected `main` branch.
+- The release workflow records artifact digests and promotes the same immutable
+  candidate without rebuilding it.
+- Only binaries built from the public repository's source and build scripts may
+  be submitted to the SignPath Foundation project.
+- Third-party or private binaries must never be signed with the community
+  project certificate.
+- Every signing request requires approval by an authorised project approver.
+- Release checksums and detached signatures are published alongside artifacts
+  and verified independently after publication.
+
+## Project roles
+
+- **Committers and reviewers:** repository collaborators listed by GitHub for
+  [`rcourtman/Pulse`](https://github.com/rcourtman/Pulse).
+- **Approvers:** the repository owner,
+  [`rcourtman`](https://github.com/rcourtman), and any future maintainer granted
+  the SignPath Approver role by the repository owner.
+
+All project members with repository or signing access must use multi-factor
+authentication. Signing access must be removed promptly when a maintainer no
+longer needs it.
+
+## User privacy and system changes
+
+Pulse's data handling and opt-out controls are documented in the
+[Privacy Policy](PRIVACY.md). Installer behavior, service creation, privileges,
+and uninstallation are documented in the [Installation Guide](INSTALL.md) and
+[Agent Security](AGENT_SECURITY.md).
+
+Security concerns involving a signed artifact should be reported using the
+private process in the repository's [Security Policy](../SECURITY.md).
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index 17213b6fe2..d05bfa6f15 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -11,6 +11,20 @@ Pulse offers flexible installation options from Docker to enterprise-ready Kuber
 > `rcourtman/pulse` image line with the private image shown on the download
 > page.
 
+## Windows code-signing status
+
+Pulse is applying to the SignPath Foundation open-source programme. Once
+approved, Windows community release artifacts will use free code signing
+provided by [SignPath.io](https://signpath.io/), with the certificate issued by
+the [SignPath Foundation](https://signpath.org/). Until that integration is
+complete, release notes identify Windows artifacts that are not
+Authenticode-signed; published checksums and detached Pulse signatures remain
+mandatory.
+
+See the [Code Signing Policy](CODE_SIGNING_POLICY.md) for build provenance,
+approval roles, signing scope, and reporting requirements. Release downloads
+are published on the [GitHub Releases page](https://github.com/rcourtman/Pulse/releases).
+
 ## 🚀 Quick Start (Recommended)
 
 ### Proxmox VE (LXC installer)