diff --git a/scripts/login-health/README.md b/scripts/login-health/README.md
index 8893b94..6a368b3 100644
--- a/scripts/login-health/README.md
+++ b/scripts/login-health/README.md
@@ -4,6 +4,17 @@ When you **SSH into koopa**, show a short **pre-collected** health snapshot so y
 
 Inventory source: `host/overview/LIVE.md`, `configs/ports.md`.
 
+## New / changed services (mandatory)
+
+Whenever a **new service** is added on koopa (or ports/vhosts change), update **in the same work package**:
+
+1. `koopa-login-health.sh` — `EXPECT_CONTAINERS`, `PROBES`, critical vs optional  
+2. `host/overview/LIVE.md` + `configs/ports.md` (and `services.md` if the diagram changes)  
+3. Deploy script to `~/.local/bin/koopa-login-health` on koopa (laptop commits/pushes; **no git commit on koopa**)  
+4. `koopa-login-health collect` so the next SSH login is not stale  
+
+Grok workflows: `koopa-services-health` (inventory drift) + `commit-rules` (planning rule 10).
+
 ## Design: no probes at login
 
 | Path | What runs |