diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 9cd091d..184898a 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -9,6 +9,7 @@
 ## :pencil: Checklist
 <!--- Put an `x` in the boxes that apply -->
 
+- [ ] All commits are signed (see [Commit signing](https://github.com/PostHog/posthog-unity/blob/main/CONTRIBUTING.md#commit-signing))
 - [ ] I reviewed the submitted code.
 - [ ] I added tests to verify the changes.
 - [ ] I updated the docs if needed.
diff --git a/AGENTS.md b/AGENTS.md
index a005227..67aa081 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,7 @@
 # Agent Instructions
 
 - Read and follow [CONTRIBUTING.md](./CONTRIBUTING.md) before contributing to the SDK.
+- Sign every commit; `main` rejects unsigned commits. Configure signing in the git config you commit with, as described in "Commit signing" in [CONTRIBUTING.md](./CONTRIBUTING.md).
 - Read and follow [RELEASING.md](./RELEASING.md) when adding changesets or working on publishing.
 - Public API changes: follow "Public API changes" in [CONTRIBUTING.md](./CONTRIBUTING.md). As an agent, also:
     - When reviewing or fixing someone else's PR, don't ask for or open an issue. Note an external contributor's public API change when it has neither an agreed issue nor an API-defining published spec.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e8a9fd7..aa824fa 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,6 +2,10 @@
 
 Thank you for your interest in contributing to the PostHog Unity SDK! This document provides guidelines and instructions for development.
 
+## Commit signing
+
+This repo requires all commits to be signed. To configure commit signing, see the [PostHog handbook](https://posthog.com/handbook/engineering/security#commit-signing). Set `commit.gpgsign` to `true` in your git config so that every commit is signed, not only the ones you sign by hand.
+
 ## Development Setup
 
 ### Prerequisites
@@ -143,6 +147,7 @@ This section is for external contributors. PostHog maintainers (members of the P
 
 ### PR Checklist
 
+- [ ] All commits are signed (see [Commit signing](#commit-signing))
 - [ ] Tests pass (`bin/test`)
 - [ ] Code is formatted (`bin/fmt --check`)
 - [ ] Documentation updated (if applicable)