diff --git a/docs/git-workflow.html b/docs/git-workflow.html
new file mode 100644
index 0000000..004326f
--- /dev/null
+++ b/docs/git-workflow.html
@@ -0,0 +1,80 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <title>Git Workflow</title>
+    <link rel="stylesheet" href="./style.css" />
+  </head>
+  <body>
+    <header>
+      <h1>Git Workflow &amp; Branch Protection</h1>
+      <div class="meta">Keep master protected; land changes via PRs with review and passing checks.</div>
+    </header>
+    <main class="grid">
+      <section class="card">
+        <h2>Remotes</h2>
+        <ul>
+          <li>Forgejo: <code>ssh://git@git.halla-aho.net:2223/thalla/lomavuokraus.git</code></li>
+          <li>Add remote if missing: <code>git remote add origin ssh://git@git.halla-aho.net:2223/thalla/lomavuokraus.git</code></li>
+          <li>Verify remotes: <code>git remote -v</code></li>
+        </ul>
+      </section>
+
+      <section class="card">
+        <h2>Daily flow</h2>
+        <ul>
+          <li>Sync master: <code>git checkout master && git pull --rebase</code></li>
+          <li>Create feature branch: <code>git checkout -b feature/&lt;name&gt;</code></li>
+          <li>Commit locally: <code>git status</code>, <code>git add</code>, <code>git commit -m "message"</code></li>
+          <li>Push branch: <code>git push -u origin feature/&lt;name&gt;</code></li>
+          <li>Open PR to master in Forgejo; wait for review + CI</li>
+          <li>After merge: <code>git checkout master && git pull --rebase && git branch -d feature/&lt;name&gt;</code></li>
+        </ul>
+      </section>
+
+      <section class="card">
+        <h2>Branch protection</h2>
+        <ul>
+          <li>Protect <code>master</code> in Forgejo (no direct pushes, require PR + ≥1 approval).</li>
+          <li>Optional: require status checks and dismiss stale approvals.</li>
+          <li>Restrict who can push to protected branches to admins/maintainers.</li>
+        </ul>
+      </section>
+
+      <section class="card">
+        <h2>Local config</h2>
+        <ul>
+          <li>Pull strategy: <code>git config pull.rebase true</code> (or false/ff-only per preference).</li>
+          <li>User: <code>git config user.name "Your Name"</code>, <code>git config user.email "you@example.com"</code></li>
+        </ul>
+      </section>
+
+      <section class="card">
+        <h2>Troubleshooting</h2>
+        <ul>
+          <li>Divergent pull: set pull strategy, rerun <code>git pull --rebase</code> or <code>git pull</code>.</li>
+          <li>Protected branch rejection: push to feature branch and open a PR.</li>
+          <li>Conflicts: <code>git status</code>, resolve, <code>git add</code>, then <code>git rebase --continue</code> or commit.</li>
+          <li>Wrong branch: <code>git checkout -b feature/fix</code>, push, open PR.</li>
+          <li>Clean merged branches: <code>git branch --merged master</code> then <code>git branch -d ...</code></li>
+        </ul>
+      </section>
+
+      <section class="card">
+        <h2>CI</h2>
+        <ul>
+          <li>Workflows live under <code>.forgejo/workflows/</code>.</li>
+          <li>Ensure checks pass before merging PRs.</li>
+        </ul>
+      </section>
+
+      <section class="card">
+        <h2>Secrets &amp; kubeconfig</h2>
+        <ul>
+          <li>Secrets: <code>creds/secrets.enc.env</code> (sops/age). Load via <code>source scripts/load-secrets.sh</code>.</li>
+          <li>Kubeconfig: <code>creds/kubeconfig.enc.yaml</code> decrypted automatically by <code>scripts/load-secrets.sh</code> when sops is available.</li>
+        </ul>
+      </section>
+    </main>
+  </body>
+</html>
diff --git a/docs/index.html b/docs/index.html
index 965d19f..85d48ce 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -19,6 +19,7 @@
           <li><a href="./architecture.html">Logical Architecture</a></li>
           <li><a href="./sequences.html">Feature Sequences</a></li>
           <li><a href="./security.html">Security Testing</a></li>
+          <li><a href="./git-workflow.html">Git Workflow</a></li>
           <li><a href="./redmine.html">Redmine Integration</a></li>
         </ul>
       </section>
