diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index ea1215d23..61966a3bf 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -9,6 +9,7 @@
 ## :pencil: Checklist
 <!--- Put an `x` in the boxes that apply -->
 
+- [ ] All commits are signed (see [Commit signing](https://github.com/PostHog/posthog-python/blob/main/CONTRIBUTING.md#commit-signing))
 - [ ] I reviewed the submitted code.
 - [ ] I added tests to verify the changes.
 - [ ] I updated the docs if needed.
diff --git a/AGENTS.md b/AGENTS.md
index 745e91ad7..60e388a4b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -5,6 +5,7 @@ Guidance for coding agents working on the PostHog Python SDK (`posthog`). Runtim
 ## Start here
 
 - Use `uv`; follow [CONTRIBUTING.md](./CONTRIBUTING.md) for setup and [checks](./CONTRIBUTING.md#ci-aligned-checks). Run the smallest relevant tests first.
+- Sign every commit; `main` rejects unsigned commits. Configure signing in the git config you commit with, as described in "Commit signing" in [CONTRIBUTING.md](./CONTRIBUTING.md).
 - For `openfeature-provider/` changes, also follow its [contributor guide](./openfeature-provider/CONTRIBUTING.md); root pytest collection does not cover it.
 - Read [RELEASING.md](./RELEASING.md) when adding changesets or changing builds/publishing. Releases publish both `posthog` and its generated `posthoganalytics` mirror.
 - For public API changes, update/review `references/public_api_snapshot.txt` and run its check as described in the contributor guide.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6625fec0c..6a8503e90 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -4,7 +4,7 @@ Thanks for your interest in improving the PostHog Python SDK.
 
 ## Commit signing
 
-This repo requires all commits to be signed. To configure commit signing, see the [PostHog handbook](https://posthog.com/handbook/engineering/security#commit-signing).
+This repo requires all commits to be signed. To configure commit signing, see the [PostHog handbook](https://posthog.com/handbook/engineering/security#commit-signing). Set `commit.gpgsign` to `true` in your git config so that every commit is signed, not only the ones you sign by hand.
 
 ## Setup