diff --git a/README.md b/README.md
index 892419d..9b93392 100644
--- a/README.md
+++ b/README.md
@@ -34,7 +34,7 @@ bash ~/.bootstrap/setup.sh --only hardening
 | 4 | shell-zsh   | zsh + oh-my-zsh + plugins, set default shell, ship config          |
 | 5 | nvm         | nvm → `~/.nvm` + Node LTS                                           |
 | 6 | nvim        | clone `g.mk.fo/bootstrap/nvim-minimal` → `~/.config/nvim`          |
-| 7 | hardening   | ssh (key-only root), ufw, updates, unattended-upgrades, tz, hostname, swapfile, locale, fail2ban |
+| 7 | hardening   | ssh (key-only root), ufw, updates, unattended-upgrades, tz, hostname, swapfile, locale, fail2ban, **angie config layout** |
 | 8 | sanity      | read-only report + recommended manual follow-ups                    |
 
 Every step is idempotent — re-running is safe.
@@ -74,6 +74,7 @@ real config there — keeps omz "happy" while your config lives under XDG.
 - **swapfile** 2G if RAM < 2G and no swap present.
 - **locale** en_US.UTF-8.
 - **fail2ban** with an sshd jail.
+- **angie config** — see [Angie config layout](#angie-config-layout) below.
 
 ## Supported hosts
 
@@ -81,12 +82,45 @@ real config there — keeps omz "happy" while your config lives under XDG.
 - Arch (via pacman + yay for AUR)
 - Architectures: `amd64`, `arm64`
 
+## Angie config layout
+
+The hardening step sets up a sane `/etc/angie/` structure (Angie is an nginx fork; same config syntax):
+
+```
+/etc/angie/
+  angie.conf          # managed by bootstrap (written once; not overwritten on re-runs)
+  mime.types          # shipped by the package — left alone
+  _on/*.conf          # enabled hosts (sites-enabled alt.)   ← included from http{}
+  targets/*.conf      # all host definitions (sites-available alt.)
+  modules/*.conf       # top-level context snippets (stream{}, env, load_module, ...)
+  modules/http/*.conf  # http{}-level snippets (upstreams, maps, real_ip, proxy defaults)
+```
+
+Convention: write each host in `targets/<name>.conf`, then enable it with
+`angie-enable <name>` (symlinks `targets/<name>.conf` → `_on/<name>.conf`, validates,
+reloads). Disable with `angie-disable <name>`. Both helpers are installed to
+`/usr/local/bin/`.
+
+The root `angie.conf` ships: `worker_processes auto`, `server_tokens off`,
+gzip, `client_max_body_size 16m`, a main `log_format`, and includes
+`modules/http/*.conf` then `_on/*.conf`. `user`/`pid`/`error_log`/`load_module`
+directives are extracted from the original packaged `angie.conf` and preserved
+(so Debian's `user angie` vs Arch's `user http` is carried over). A backup is
+kept at `/etc/angie/angie.conf.orig.bootstrap`.
+
+Defaults shipped:
+- `modules/http/00-common.conf` — `real_ip` from private ranges (Cloudflare commented), `proxy_set_header` defaults (inherited by every server/location).
+- `_on/00-default.conf` — `default_server` returning `444` for requests that match no enabled host (drops drive-by scanners / bare-IP probes).
+
 ## Notes
 
+- Distro-guarded package-manager aliases ship in `aliases.zsh`:
+  `pac`/`pacs`/`pacu`/`pacy`/`pa` (Arch, `sudo pacman …`) and
+  `apt`/`apti`/`aptu`/`apts`/`aptsh` (Debian/Ubuntu, `sudo apt …`).
 - `aliases-extras.zsh` is seeded once and then left alone — re-running the
   shell-zsh step won't clobber your personal aliases.
 - On Debian, `fd`/`bat` ship as `fdfind`/`batcat`; symlinks to the canonical
   names are created in `~/.local/bin` (which is on `PATH` via `path.zsh`).
 - Some Go/Rust CLIs (`dust`, `duf`, `procs`, `lazygit`) are fetched from
   the latest GitHub release tarball when the distro package is missing; this
-  is best-effort and warned (not fatal) on failure.
\ No newline at end of file
+  is best-effort and warned (not fatal) on failure.