diff --git a/CHANGELOG.md b/CHANGELOG.md
index 69d9952..565ac11 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,12 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+
+- **Docs: point consumers at `saw guard`** (from the `stayawakebot` package) as the automated way to install and verify this gate. `saw guard setup` installs it SHA-pinned to the latest release and opens pin-bump PRs; `saw guard check` verifies it is present, SHA-pinned, current, and a required check. The manual copy-paste + hardening checklist remain the source of truth (the least-privilege `contents: read` default and remediation-as-opt-in posture are unchanged).
+
 ## [0.1.4] — 2026-07-15
 
 ### Added
diff --git a/README.md b/README.md
index 4ee2de2..3a6c054 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,8 @@ jobs:
 `fetch-depth: 0` is required for evil-merge detection (it needs the full commit graph). Deploying
 this as a required check is the whole point — see the [hardening checklist](docs/HARDENING.md).
 
+**Install and keep it current with `saw guard`.** From the `stayawakebot` package, `saw guard setup` installs this gate **SHA-pinned to the latest Strix release** and proposes pin bumps via PR, and `saw guard check` verifies it is present, SHA-pinned, current, and a required check — across a single repo or a whole account/org. It is the automated path to the hardening checklist below; the snippet above is the manual equivalent.
+
 ## Inputs
 
 | Input | Default | Description |
diff --git a/docs/HARDENING.md b/docs/HARDENING.md
index c91cbb4..3b1b7c4 100644
--- a/docs/HARDENING.md
+++ b/docs/HARDENING.md
@@ -13,6 +13,8 @@ below get you there.
 
 ## Hardening checklist
 
+**Automate most of this with `saw guard`** (from the `stayawakebot` package): `saw guard setup` installs the gate SHA-pinned and opens pin-bump PRs; `saw guard check -f` verifies it is present, SHA-pinned, current, and a required check, and gates CI on the result. The steps below remain the source of truth — **CODEOWNERS review** and **`fetch-depth: 0`** in particular are yours to set, not something the installer can do for you.
+
 - [ ] **Make the Strix job a required status check** on your default branch, so a renamed or removed
   job blocks a merge instead of silently passing.
 - [ ] **Check out with `fetch-depth: 0`** so evil-merge detection sees the full commit graph and