diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index ca33fb8..37db927 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -94,9 +94,11 @@ bypass actors:
 
     gh api repos/Flowfin/site/rulesets/20572614 \
       --jq '{enforcement, bypass: .bypass_actors, required: [.rules[].type]}'
-    {"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request"]}
+    {"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request","required_signatures"]}
 
-Run 2026-08-09.
+Run 2026-08-30. The last rule in that list is why a commit reaching `main` here
+has to be signed as well as signed off: the trailer below is the assertion, and
+the signature is what the branch refuses a merge without.
 
 Nothing refuses a pull request that closes no issue, and nothing checks that the
 number in a commit subject belongs to an issue that exists. The rule is held by
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index 67cba2d..696aa13 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -36,9 +36,9 @@ Every change starts as an issue and lands as a pull request. Direct pushes to
     20572614
     gh api repos/Flowfin/site/rulesets/20572614 \
       --jq '{enforcement, bypass: .bypass_actors, required: [.rules[].type]}'
-    {"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request"]}
+    {"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request","required_signatures"]}
 
-Run 2026-08-08. Two things that output does not carry are worth naming rather
+Run 2026-08-30. Two things that output does not carry are worth naming rather
 than leaving a reader to notice.
 
 The ruleset requires no approving review, so a pull request here is merged by
diff --git a/docs/parity.md b/docs/parity.md
index ddc8aa8..f954cad 100644
--- a/docs/parity.md
+++ b/docs/parity.md
@@ -19,9 +19,9 @@ Run 2026-08-08.
 ## Where this repository stands
 
     gh api repos/Flowfin/site/rulesets/20572614 --jq '[.rules[].type]'
-    ["deletion","non_fast_forward","pull_request"]
+    ["deletion","non_fast_forward","pull_request","required_signatures"]
 
-Run 2026-08-08. No status check is required here at all, so the gap is the whole
+Run 2026-08-30. No status check is required here at all, so the gap is the whole
 list. Every row below says what the check becomes; none of them says that
 anything is required yet.
 
@@ -200,16 +200,25 @@ left on with a reason recorded here, is not a change to this tree either.
 ## What this repository requires that the target does not
 
 Nothing, today, and the sentence is written this way round because the plan
-expected the opposite. Verified signatures on the default branch would be an
-addition rather than parity, and neither ruleset carries the rule:
+expected the opposite. Verified signatures on the default branch would have been
+an addition rather than parity, and both rulesets carry the rule:
 
     gh api repos/Flowfin/jellyfin-plugin-sso/rulesets/18802863 --jq '[.rules[].type]'
-    ["deletion","non_fast_forward","required_status_checks","pull_request"]
+    ["deletion","non_fast_forward","required_status_checks","pull_request","required_signatures"]
     gh api repos/Flowfin/site/rulesets/20572614 --jq '[.rules[].type]'
-    ["deletion","non_fast_forward","pull_request"]
+    ["deletion","non_fast_forward","pull_request","required_signatures"]
 
-Run 2026-08-08. Commits reaching this repository are signed in practice, and
-nothing at either branch refuses one that is not.
+Run 2026-08-30. The answer above is unchanged and what holds it up is not. It
+held because neither branch carried the rule; it holds because both do, so the
+difference this section would have recorded never became one. Each branch now
+refuses an unsigned commit rather than leaving it to the practice of whoever
+pushes, and the readings that said otherwise were taken three weeks before this
+repository's ruleset was last written:
+
+    gh api repos/Flowfin/site/rulesets/20572614 --jq '.updated_at'
+    "2026-08-28T14:22:58.455+02:00"
+
+Run 2026-08-30.
 
 ## What this repository adds, because it serves pages rather than shipping a plugin