diff --git a/.gitignore b/.gitignore
index 7aacbbb6..e2e7fdcf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -62,6 +62,13 @@ coverage/
 releases/**
 !releases/
 !releases/manifest.json
+# The signed app catalog and the registry trust floor are source, not build
+# output: nodes fetch the catalog from this path on main, and the floor is what
+# scripts/check-catalog-registry-trust.py checks it against. Both were being
+# swallowed by the rule above — app-catalog.json only stayed tracked because it
+# predates it.
+!releases/app-catalog.json
+!releases/registry-trust-floor.json
 
 # Image recipe output
 image-recipe/output/
diff --git a/releases/registry-trust-floor.json b/releases/registry-trust-floor.json
new file mode 100644
index 00000000..4f71cbe3
--- /dev/null
+++ b/releases/registry-trust-floor.json
@@ -0,0 +1,33 @@
+{
+  "_comment": [
+    "Registry hosts that binaries ALREADY DEPLOYED to nodes are known to trust.",
+    "",
+    "This is the floor the signed app catalog must stay within. It is NOT the",
+    "same as TRUSTED_REGISTRIES in the working tree: that list describes what a",
+    "binary being built today accepts, while nodes in the field run whatever was",
+    "shipped to them. Publishing a catalog that names a host the fleet's binaries",
+    "do not trust makes every install fail with 'not from a trusted registry'.",
+    "",
+    "To migrate to a new registry host, in this order:",
+    "  1. Add the host to TRUSTED_REGISTRIES and ship a binary OTA.",
+    "  2. Confirm the fleet is running that binary or newer.",
+    "  3. Add the host here, in the same commit as the confirmation.",
+    "  4. Only then regenerate and re-sign the catalog against the new host.",
+    "",
+    "Removing a host is the mirror image: take it out of the catalog first, let",
+    "that catalog reach every node, and only then drop it from here."
+  ],
+  "hosts": [
+    "docker.io",
+    "ghcr.io",
+    "localhost",
+    "146.59.87.168:3000"
+  ],
+  "pending": {
+    "source.archipelago-foundation.org": {
+      "trusted_from_binary": "unreleased",
+      "note": "Added to TRUSTED_REGISTRIES 2026-08-07. Not yet shipped in any OTA, so no deployed node accepts it. Promote to `hosts` only after the fleet is confirmed on a binary that includes it."
+    }
+  },
+  "updated": "2026-08-07"
+}