diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..67d5b45
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,8 @@
+# Contributing
+
+- Changes land via pull request — no direct pushes to `main`. Branch protection enforces
+  this (see README.md, "Branch protection on `main`").
+- This applies to the Claude bot too: it only ever opens PRs, never pushes or merges
+  directly. `claude-bot`'s account is deliberately excluded from the merge whitelist, so a
+  human always reviews and merges.
+- Open a PR against `main` and wait for review before merging.