BryanFRD · Oct 31, 2026 · Oct 31, 2026 · Oct 31, 2026
diff --git a/.github/logo.svg b/.github/logo.svg
diff --git a/README.md b/README.md
@@ -1,12 +1,14 @@
 <div align="center">
 
-# FerrLabs `.github`
+<h1><img src=".github/logo.svg" alt="" width="48" height="48" align="absmiddle"> FerrLabs <code>.github</code></h1>
 
 **Organization-level defaults for every FerrLabs repository.**
 
 Community health files, the org profile, shared reusable workflows and config presets,<br />
 inherited automatically by any repo that does not ship its own version.
 
+[![License](https://img.shields.io/github/license/FerrLabs/.github)](LICENSE)
+
 [github.com/FerrLabs](https://github.com/FerrLabs)
 
 </div>
@@ -16,8 +18,8 @@ inherited automatically by any repo that does not ship its own version.
 | Path | Purpose |
 |------|---------|
 | `profile/README.md` | The public [organization profile](https://github.com/FerrLabs) page. |
-| `.github/workflows/` | **Reusable workflows** (`reusable-ci-*`, `reusable-docker-build`, `reusable-release-rust`, `reusable-security-scan`, `reusable-sonarqube-scan`) called by repos via `workflow_call`. |
-| `workflow-templates/` | **Starter workflows** shown under *Actions → New workflow* (CI for Astro/Go/Node/Rust, CodeQL, docker-publish, release, scorecard, pr-title, security-scan), each with its `.properties.json`. |
+| `.github/workflows/` | **Reusable workflows** (`reusable-ci-*` for Astro, Go, Node and Rust, `reusable-dco`, `reusable-docker-build`, `reusable-ferrflow-release`, `reusable-fuzz-rust`, `reusable-pr-title`, `reusable-release-rust`, `reusable-security-scan`, `reusable-sonarqube-scan`) called by repos via `workflow_call`. |
+| `workflow-templates/` | **Starter workflows** shown under *Actions → New workflow* (CI for Astro/Go/Node/Rust, dco, docker-publish, release, sbom-track, scorecard, pr-title, security-scan), each with its `.properties.json`. |
 | `snippets/` | Config files to **copy into** repos: `CODEOWNERS`, `renovate.json`, `dependabot.yml`, `deny.toml`, `typos.toml`, `.gitleaksignore`, `.trivyignore`. Not inherited; these are templates to drop in. |
 | `default.json` / `renovate.json` | Shared **Renovate** config. `default.json` is the global config of the self-hosted Renovate (a CronJob in FerrLabs/Infra, `platform/renovate`); `renovate.json` is the org-wide preset. |
 | `SECURITY.md`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SUPPORT.md` | Community health files inherited org-wide. |

diff --git a/profile/README.md b/profile/README.md
@@ -1,55 +1,55 @@
 <div align="center">
 
-# FerrLabs
+<h1><img src="https://raw.githubusercontent.com/FerrLabs/.github/main/.github/logo.svg" alt="" width="48" height="48" align="absmiddle"> FerrLabs</h1>
 
 **Developer tools for teams that ship.**
 
-[ferrlabs.com](https://ferrlabs.com) · [status](https://status.ferrlabs.com) · [changelog](https://ferrlabs.com/changelog)
+[ferrlabs.com](https://ferrlabs.com) | [status](https://status.ferrlabs.com) | [changelog](https://ferrlabs.com/changelog)
 
 </div>
 
 ---
 
-We build small, opinionated tools for the parts of the dev workflow you should not have to think about. One org, one login, one bill across every product — and FerrFlow stays free inside all of them.
+We build small, opinionated tools for the parts of the dev workflow you should not have to think about. One org, one login, one bill across every product, and FerrFlow stays free inside all of them.
 
 ## Products
 
 | Product | What it does | |
 |---|---|---|
-| **FerrFlow** | Releases your code. Reads your conventional commits, bumps the version, writes the changelog, tags and publishes — one binary, any language. | [ferrflow.com](https://ferrflow.com) |
+| **FerrFlow** | Releases your code. Reads your conventional commits, bumps the version, writes the changelog, tags and publishes, one binary, any language. | [ferrflow.com](https://ferrflow.com) |
 | **FerrVault** | Stores your secrets and hands them to your apps, without running the infrastructure yourself. | [ferrvault.com](https://ferrvault.com) |
-| **FerrTrack** | Tracks your issues. A keyboard-first, git-aware tracker for product teams — no SLAs or AI summaries you didn't ask for. | [ferrtrack.com](https://ferrtrack.com) |
+| **FerrTrack** | Tracks your issues. A keyboard-first, git-aware tracker for product teams, no SLAs or AI summaries you didn't ask for. | [ferrtrack.com](https://ferrtrack.com) |
 | **FerrGrowth** | Builds and ships your marketing site: pages, forms, SEO audits, analytics. | [ferrgrowth.com](https://ferrgrowth.com) |
-| **FerrFleet** | Runs your AI agents and shows you what they actually did — execution plus observability. | [ferrfleet.com](https://ferrfleet.com) |
+| **FerrFleet** | Runs your AI agents and shows you what they actually did: execution plus observability. | [ferrfleet.com](https://ferrfleet.com) |
 | **FerrLens** | Checks your stack. Free standalone tools for SEO, DNS, email (SPF/DKIM/DMARC), TLS, and everyday dev chores. | [ferrlens.com](https://ferrlens.com) |
 | **FerrGames** | Small multiplayer party games to play with friends. In the browser, no account needed. | [ferrgames.com](https://ferrgames.com) |
 
 ## Open source
 
-### [FerrFlow](https://github.com/FerrLabs/FerrFlow) · v7
+### [FerrFlow](https://github.com/FerrLabs/FerrFlow)
 
-Universal semantic versioning. One Rust binary reads your conventional commits, bumps versions across your monorepo (14+ file formats — `Cargo.toml`, `package.json`, `pyproject.toml`, `Chart.yaml`, `mix.exs`, gemspec, `pubspec.yaml`, …), generates changelogs, tags, and ships GitHub releases. Drop it into any CI.
+Universal semantic versioning. One Rust binary reads your conventional commits, bumps versions across your monorepo (16 file formats: `Cargo.toml`, `package.json`, `pyproject.toml`, `Chart.yaml`, `mix.exs`, gemspec, `pubspec.yaml`, and more), generates changelogs, tags, and ships GitHub releases. Drop it into any CI.
 
 ```bash
 cargo install ferrflow
 # or
 uses: FerrLabs/FerrFlow@v7
 ```
 
-→ [Docs & playground at ferrflow.com](https://ferrflow.com)
+[Docs and playground at ferrflow.com](https://ferrflow.com)
 
 ### [FerrVault Operator](https://github.com/FerrLabs/FerrVault)
 
-Kubernetes operator (Go) that syncs FerrVault secrets into native `kind: Secret`. Two CRDs — `FerrVaultConnection` and `FerrVaultSecret`. Pairs with FerrVault SaaS, works just as well against a self-hosted instance.
+Kubernetes operator (Go) that syncs FerrVault secrets into native `kind: Secret`. Two CRDs: `FerrVaultConnection` and `FerrVaultSecret`. Pairs with FerrVault SaaS, works just as well against a self-hosted instance.
 
 ### [MCP](https://github.com/FerrLabs/MCP)
 
-Model Context Protocol server. Lets AI assistants drive the suite — cut a release, read issues, manage secrets, query analytics.
+Model Context Protocol server. Lets AI assistants drive the suite: cut a release, read issues, manage secrets, query analytics.
 
 ### Tooling around FerrFlow
 
-- **[Fixtures](https://github.com/FerrLabs/Fixtures)** — declarative git fixture generator. Reproducible repos for integration tests and benchmarks.
-- **[Benchmarks](https://github.com/FerrLabs/Benchmarks)** — reusable GitHub Action that runs the FerrFlow perf suite and reports regressions on every PR.
+- **[Fixtures](https://github.com/FerrLabs/Fixtures)**: declarative git fixture generator. Reproducible repos for integration tests and benchmarks.
+- **[Benchmarks](https://github.com/FerrLabs/Benchmarks)**: reusable GitHub Action that runs the FerrFlow perf suite and reports regressions on every PR.
 
 ## Principles
 
@@ -67,5 +67,5 @@ or [BryanFRD](https://github.com/sponsors/BryanFRD).
 ---
 
 <div align="center">
-<sub><a href="https://ferrlabs.com">ferrlabs.com</a> · <a href="mailto:contact@ferrlabs.com">contact@ferrlabs.com</a></sub>
+<sub><a href="https://ferrlabs.com">ferrlabs.com</a> | <a href="mailto:contact@ferrlabs.com">contact@ferrlabs.com</a></sub>
 </div>