diff --git a/README.md b/README.md
index 504b1a0..93879eb 100644
--- a/README.md
+++ b/README.md
@@ -114,6 +114,15 @@ graph TB
   - If `active_seats >= max_seats`, the hub rejects registration with `HTTP 403 (License seat limit reached)`.
   - Existing registered clients can re-enroll / renew seamlessly without consuming additional seats.
 
+### 4. In-Flight Certificate Watchdog & Automated Self-Healing Renewal
+- **Continuous Hub PKI Watchdog**:
+  - The server hub runs a continuous background watchdog coroutine (`cert_validity_watchdog`, running every 12 hours) alongside startup checks.
+  - The hub automatically inspects expiration dates of both the Root CA (`ca.crt`) and the Server TLS certificate (`server.crt`).
+  - If either certificate is within 30 days of expiration, the server regenerates certificates (backing up previous keys as `ca.crt.<timestamp>.bak`) and dynamically reloads its active `ssl.SSLContext` in memory without dropping socket connections or restarting the service.
+- **Client Proactive Check & Reactive Self-Healing**:
+  - **Proactive Renewal**: Edge clients inspect `client.crt` before every run cycle. If the certificate expires in less than 30 days, it automatically contacts `/api/client/enroll` to renew its certificate.
+  - **Reactive Self-Healing**: If the server hub Root CA rotates or a handshake fails with `ssl.SSLError` / `SSLCertVerificationError`, edge clients catch the verification exception, re-bootstrap certificate enrollment against the hub, and re-establish the connection cleanly without human intervention.
+
 ---
 
 ## Cloud-Side Temporal Persistence & 4-Run Rule