diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index 85ed5cd3b..a1336cdab 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -14,5 +14,15 @@ reviews:
     - "!**/*.ts"
     - "!**/*.js"
     - "!**/*.svg"
+  pre_merge_checks:
+    custom_checks:
+      - name: "No attribution trailers"
+        mode: error
+        instructions: >-
+          Fail when the PR description or any commit message carries an
+          attribution trailer or footer: Co-Authored-By, Claude-Session,
+          Generated-By, or a "Generated with"/"Generated by" tool line.
+          Contributors own their contributions (AGENTS.md); ask for the
+          lines to be removed.
 chat:
   auto_reply: true
diff --git a/.githooks/commit-msg b/.githooks/commit-msg
new file mode 100755
index 000000000..e5699bd9c
--- /dev/null
+++ b/.githooks/commit-msg
@@ -0,0 +1,26 @@
+#!/bin/bash
+# Refuses commit messages that carry attribution trailers. Contributors own
+# their contributions (AGENTS.md, "No Co-Authored-By or tool-attribution
+# trailers"); a trailer spreads that ownership onto a tool or a bystander.
+
+msg_file="$1"
+
+# Trailer keys in any casing, with any bullet or emoji in front.
+trailers='^[^[:alnum:]]*(co-authored-by|claude-session|generated-by):'
+# "Generated with/by" footers, including "Generated with <emoji> by".
+footer='^[^[:alnum:]]*generated (with|by)( [^[:alnum:]]*by)? '
+# A footer names a product, so a capitalized word must follow the phrase
+# itself. Prose such as "generated by the protobuf compiler" stays legal.
+tool='[Gg][Ee][Nn][Ee][Rr][Aa][Tt][Ee][Dd] ([Ww][Ii][Tt][Hh]|[Bb][Yy])( [^[:alnum:]]*[Bb][Yy])? [^[:alnum:]]*[A-Z]'
+
+offending=$( {
+    grep -Ein "$trailers" "$msg_file"
+    grep -Ein "$footer" "$msg_file" | grep -E "$tool"
+} | sort -un )
+
+if [ -n "$offending" ]; then
+    echo "commit-msg: attribution trailers are not accepted in this repository:" >&2
+    printf '%s\n' "$offending" | sed 's/^/  /' >&2
+    echo "Remove them and commit again (see AGENTS.md)." >&2
+    exit 1
+fi
diff --git a/AGENTS.md b/AGENTS.md
index 5497acb15..3838a7913 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -77,7 +77,7 @@ make lint            # golangci-lint on files changed vs origin/main (also the p
 make lint-all        # full-repository lint, matches CI
 make test-unit       # host-safe unit tests, -tags devcert, no sudo
 make test-privileged # privileged-tagged suite in a Docker container with NET_ADMIN
-make setup-hooks     # wire make lint into .githooks/pre-push
+make setup-hooks     # wire .githooks: pre-push runs make lint, commit-msg refuses attribution trailers
 
 # Narrow runs
 go test ./client/internal/dns/...
diff --git a/CLAUDE.md b/CLAUDE.md
index 764f406be..72681748e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1 +1,4 @@
-See [AGENTS.md](AGENTS.md) for the agent guidelines in this repository.
+The agent guidelines live in [AGENTS.md](AGENTS.md). It is imported here so
+every session loads it in full rather than following a pointer.
+
+@AGENTS.md
diff --git a/Makefile b/Makefile
index 0a4fad2f2..26c5b932e 100644
--- a/Makefile
+++ b/Makefile
@@ -23,8 +23,8 @@ lint-install: $(GOLANGCI_LINT)
 # Setup git hooks for all developers
 setup-hooks:
 	@git config core.hooksPath .githooks
-	@chmod +x .githooks/pre-push
-	@echo "✅ Git hooks configured! Pre-push will now run 'make lint'"
+	@chmod +x .githooks/pre-push .githooks/commit-msg
+	@echo "✅ Git hooks configured! Pre-push runs 'make lint'; commit-msg refuses attribution trailers"
 
 # Host-safe unit tests: excludes the privileged-tagged tests (root / system-mutating).
 # Runs as a normal user with no sudo and leaves host networking untouched.