diff --git a/docs/README.md b/docs/README.md
index b9dd1a5..4209345 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -14,13 +14,15 @@ cd verae-staff-ui/docs
 
 ```sh
 # From this package in the monorepo, open sibling operator docs:
-ls ../../verae-staff-iam/ENROLL.md ../../verae-staff-iam/TOTP.md ../../zappier-edge/SUPPORT.md
+ls ../../verae-staff-iam/ENROLL.md ../../verae-staff-iam/TOTP.md \
+  ../../verae-staff-iam/docs/PRODUCTION-PKI-REFUSE.md ../../zappier-edge/SUPPORT.md
 ```
 
 Operator references (sibling packages):
 
 - [Device certificate enrollment (mTLS)](../../verae-staff-iam/ENROLL.md) — `staff-iam` ENROLL; proxy headers, no PKI mint here
 - [Staff authenticator (TOTP)](../../verae-staff-iam/TOTP.md) — `staff-iam` TOTP setup / `STAFF_TOTP_REQUIRED`
+- [Production PKI refuse matrix](../../verae-staff-iam/docs/PRODUCTION-PKI-REFUSE.md) — lab-only 201 vs production 501; no live mint
 - [Staff support APIs](../../zappier-edge/SUPPORT.md) — `zappier-edge` `/admin/api/support/*` for CS diagnosis
 
 ## Contributing