diff --git a/CLAUDE.md b/CLAUDE.md
index 49b1108..c4a0e38 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -29,6 +29,11 @@ Each agent directory contains 5 files:
 | `TOOLS.md` | Available CLI tools registry |
 | `CONFIG.md` | Operational backup — identity table, adapter config, heartbeat config |
 
+## Infrastructure Policy
+
+- **Container images**: Push to `ghcr.io` only. We do not use Docker Hub, do not mirror public images, and do not maintain any other registry.
+- **Dependency updates**: Managed by **Mend Renovate**. We do not use Dependabot — never enable it, never create `.github/dependabot.yml`, never reference it in workflows or docs.
+
 ## Key Operational Notes
 
 - **Prompt wipe on adapter switch**: Switching an agent's adapter in the Paperclip UI wipes `promptTemplate`. Always restore from this repo after any adapter switch.