diff --git a/CLAUDE.md b/CLAUDE.md
index 1535aea..dc3556a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,6 +10,10 @@ Personal dotfiles managed with GNU stow. Full details: README.md.
 - `bootstrap.sh` installs + stows everything (idempotent, safe to re-run).
   `doctor.sh` is read-only drift detection only — never edits anything.
 
+- `KNOWLEDGE_REPO`/`KNOWLEDGE_DIR` in `lib.sh` point at the private OKF
+  knowledge repo; bootstrap clones it and doctor checks its origin. Never run
+  code from it, and never add a `knowledge/` directory or link here.
+
 ## Conventions
 - New dotfile: create/extend a package dir mirroring `$HOME`, then add the
   package name to `STOW_PACKAGES` in `lib.sh`. Don't hand-symlink or
diff --git a/README.md b/README.md
index 16a7633..4d3caec 100644
--- a/README.md
+++ b/README.md
@@ -119,6 +119,20 @@ repo. `doctor.sh` flags it if it ever folds back.
 
 ---
 
+## Private knowledge bundles
+
+Claude Code's [Open Knowledge Format](https://github.com/GoogleCloudPlatform/open-knowledge-format)
+bundles live in a separate private repo, `jpmontez/knowledge`, cloned to
+`~/Development/knowledge`. Claude Code reads them from there by directory name;
+nothing from it is linked into this or any other repo, and nothing in it is
+executed.
+
+Bootstrap clones it when `gh` is signed in with access, and otherwise skips the
+step. `doctor.sh` checks the clone's origin. It's optional, so a fork without
+access loses nothing.
+
+---
+
 ## Submodules
 
 | Submodule                     | Repo                                   |
@@ -133,7 +147,7 @@ repo. `doctor.sh` flags it if it ever folds back.
 ## Post-Install
 
 1. **SSH keys** — copy or generate into `~/.ssh/` (`ssh-keygen -t ed25519`). It's a real directory, so keys stay out of the working tree.
-2. **GitHub CLI** — `gh auth login`.
+2. **GitHub CLI** — `gh auth login`, then re-run `./bootstrap.sh` to clone the private knowledge repo.
 3. **App Store** — sign in, then re-run `brew bundle` if `mas` entries were skipped.
 4. **tmux plugins** — TPM auto-installs on first launch; `prefix + I` after adding plugins later.
 5. **Check your work** — `./doctor.sh` should come back clean.
diff --git a/bootstrap.sh b/bootstrap.sh
index f9fcb63..72d0b09 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -199,6 +199,18 @@ if [[ "$SHELL" != "$ZSH_PATH" ]]; then
   chsh -s "$ZSH_PATH" || echo ">>> Warning: could not change default shell automatically; run 'chsh -s $ZSH_PATH' manually."
 fi
 
+# ---- Private knowledge bundles ----
+# Optional: needs a GitHub login that can see the repo, so a first run on a new
+# machine (before `gh auth login`) or a fork just skips it.
+if [[ ! -d "$KNOWLEDGE_DIR" ]]; then
+  if gh auth status &>/dev/null && gh repo view "$KNOWLEDGE_REPO" &>/dev/null; then
+    echo ">>> Cloning $KNOWLEDGE_REPO..."
+    gh repo clone "$KNOWLEDGE_REPO" "$KNOWLEDGE_DIR"
+  else
+    echo ">>> Skipping $KNOWLEDGE_REPO (not signed in to gh, or no access). Re-run after gh auth login."
+  fi
+fi
+
 # ---- macOS system defaults ----
 applied_defaults=0
 if [[ "$PLATFORM" == "macos" ]] && (( APPLY_DEFAULTS )); then
diff --git a/doctor.sh b/doctor.sh
index b9095dc..ae1f5ae 100755
--- a/doctor.sh
+++ b/doctor.sh
@@ -142,6 +142,20 @@ else
   ok "working tree clean"
 fi
 
+# Read-only: compares the clone's origin and never runs anything from it.
+if [[ -d "$KNOWLEDGE_DIR/.git" ]]; then
+  # Strip any user:token@ before the URL is compared or printed.
+  origin="$(git -C "$KNOWLEDGE_DIR" remote get-url origin 2>/dev/null | sed -E 's#^([a-z+]+://)[^/@]*@#\1#' || true)"
+  if [[ "$origin" =~ github\.com[:/]${KNOWLEDGE_REPO}(\.git)?$ ]]; then
+    ok "knowledge repo $KNOWLEDGE_REPO at $KNOWLEDGE_DIR"
+  else
+    bad "$KNOWLEDGE_DIR has origin '${origin:-none}', want $KNOWLEDGE_REPO"
+    hint "git -C $KNOWLEDGE_DIR remote -v"
+  fi
+else
+  ok "no private knowledge repo at $KNOWLEDGE_DIR (optional)"
+fi
+
 # ---------------------------------------------------------------------------
 section "Environment"
 # ---------------------------------------------------------------------------
diff --git a/lib.sh b/lib.sh
index 040af94..930b30d 100644
--- a/lib.sh
+++ b/lib.sh
@@ -20,6 +20,13 @@ STOW_PACKAGES=(zsh git tmux ghostty nvim claude)
 # every key or known_hosts file written there would land in the working tree.
 SSH_STOW_OPTS=(--no-folding)
 
+# Private repo holding Claude Code's OKF knowledge bundles. bootstrap clones it
+# when the GitHub account can see it; doctor checks the clone's origin. Nothing
+# in it is executed or linked into place. Optional: a fork without access skips
+# it.
+KNOWLEDGE_REPO="jpmontez/knowledge"
+KNOWLEDGE_DIR="$HOME/Development/knowledge"
+
 if [[ "$(uname)" == "Darwin" ]]; then
   PLATFORM="macos"
 else