diff --git a/.gitignore b/.gitignore
index 934595e..b9f8ba9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,13 @@ mise.local.toml
 *.apk
 *.idsig
 
+# Local MG4 platform-signing material. Keep the working copies inside this
+# checkout for self-contained release builds, but never publish private keys.
+/tools/platform.pk8
+/tools/platform.x509.pem
+/tools/platform.key
+/tools/platform.p12
+
 # Build dirs of the vendored EVHardware library.
 /EVHardware/build
 /EVHardware/.gradle
diff --git a/OTA.md b/OTA.md
index 5dc5c23..fec7c7b 100644
--- a/OTA.md
+++ b/OTA.md
@@ -70,7 +70,8 @@ The version comes from the **asset filename**, not the git tag. The tag can stay
 
    ```bash
    BT=~/Android/Sdk/build-tools/35.0.0
-   KEYS=~/Desktop/Coding/MG/DriveHub_Kamera/tools
+   # Local copies from DriveHub_Kamera/tools; private and gitignored.
+   KEYS="$PWD/tools"
 
    "$BT/zipalign" -f 4 \
      app/build/outputs/apk/unstable/debug/app-unstable-debug.apk aligned.apk
diff --git a/tools/README.md b/tools/README.md
new file mode 100644
index 0000000..3f87bab
--- /dev/null
+++ b/tools/README.md
@@ -0,0 +1,13 @@
+# Local MG4 signing tools
+
+Place the two DriveHub platform-signing files in this directory:
+
+- `platform.pk8`
+- `platform.x509.pem`
+
+They sign the unstable vehicle APK described in `../OTA.md`. The expected
+certificate SHA-256 is
+`c8a2e9bccf597c2fb6dc66bee293fc13f2fc47ec77bc6b2b0d52c11f51192ab8`.
+
+The signing files are intentionally ignored by Git. Do not publish the private
+key; release APKs remain reproducible locally from this checkout.