diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 9cd091d1..01531de9 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -9,6 +9,7 @@
 ## :pencil: Checklist
 <!--- Put an `x` in the boxes that apply -->
 
+- [ ] All commits are signed (see [Commit signing](https://github.com/PostHog/posthog-ruby/blob/main/CONTRIBUTING.md#commit-signing))
 - [ ] I reviewed the submitted code.
 - [ ] I added tests to verify the changes.
 - [ ] I updated the docs if needed.
diff --git a/AGENTS.md b/AGENTS.md
index c252111f..676f3bd1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,7 @@
 # Agent Instructions
 
 - Read and follow [CONTRIBUTING.md](./CONTRIBUTING.md) before contributing to the SDK.
+- Sign every commit; `main` rejects unsigned commits. Configure signing in the git config you commit with, as described in "Commit signing" in [CONTRIBUTING.md](./CONTRIBUTING.md).
 - Read and follow [RELEASING.md](./RELEASING.md) when adding changesets or working on publishing.
 - Public API changes: follow "Public API changes" in [CONTRIBUTING.md](./CONTRIBUTING.md). As an agent, also:
     - When reviewing or fixing someone else's PR, don't ask for or open an issue. Note an external contributor's public API change when it has neither an agreed issue nor an API-defining published spec.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1d7956c4..2679fc6d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,6 +2,10 @@
 
 Thanks for your interest in improving the PostHog Ruby SDK.
 
+## Commit signing
+
+This repo requires all commits to be signed. To configure commit signing, see the [PostHog handbook](https://posthog.com/handbook/engineering/security#commit-signing). Set `commit.gpgsign` to `true` in your git config so that every commit is signed, not only the ones you sign by hand.
+
 ## Developing locally
 
 1. Install `asdf` to manage your Ruby version: `brew install asdf`