diff --git a/docs/PLAN.md b/docs/PLAN.md
index 9ed838e..8b54b3f 100644
--- a/docs/PLAN.md
+++ b/docs/PLAN.md
@@ -55,6 +55,15 @@ JSON). Speaking the Firecrawl v2 wire shape means **no Hermes code changes on an
   - `modernc.org/sqlite` (pure Go, no cgo) for cache/metrics;
   - stdlib `net/http` server (or `chi`), `log/slog`, `context` timeouts.
   Single static binary; Nix packaging via `buildGoModule`.
+- **Makefile for non-Nix hosts** (Kyle, 2026-09-22: in case the infrastructure substrate ever
+  changes). Targets: `build` (`CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X
+  main.version=$(VERSION)"`), `test` (`go test -race ./...`), `lint` (`go vet`, plus
+  `staticcheck` if present), `contract` (the Hermes contract-test harness), `install`
+  (binary → `$(PREFIX)/bin`, `PREFIX ?= /usr/local`; example config → `/etc/sift/`;
+  a plain systemd unit from `dist/sift.service` with the same hardening as the NixOS module),
+  and `clean`. The Makefile is the source of truth for build flags; the flake's
+  `buildGoModule` uses the same `-trimpath`/`ldflags`, and CI/`nix flake check` runs
+  `make test lint`, so the two paths can't drift. Nothing in the service may assume Nix paths.
 - Bind `127.0.0.1:8890`; expose on the tailnet with `tailscale serve --bg --https=8443
   http://127.0.0.1:8890` → `https://orion.scylla-hammerhead.ts.net:8443`. No firewall hole
   (same pattern as SearXNG).
@@ -221,7 +230,7 @@ tests + one live `web_extract`).
 
 | Phase | Scope | Done when |
 |---|---|---|
-| **P0** skeleton | repo, flake, NixOS module, `/healthz`, URL guard + exhaustive unit tests (table of private/tailnet/rebinding/redirect cases incl. `http://100.95.252.120:8000`, `http://dixie:11434`, `http://[fd7a:115c:a1e0::1]`, decimal/octal IPs, redirect-to-private) | tests green; Claude security review of the guard passes |
+| **P0** skeleton | repo, flake, NixOS module, Makefile (+ `dist/sift.service`), `/healthz`, URL guard + exhaustive unit tests (table of private/tailnet/rebinding/redirect cases incl. `http://100.95.252.120:8000`, `http://dixie:11434`, `http://[fd7a:115c:a1e0::1]`, decimal/octal IPs, redirect-to-private) | tests green; Claude security review of the guard passes |
 | **P1** clean fetch | `/v2/scrape` (html/json/text → clean), limits, auth, logging; deployed on orion; talos wired | `web_extract` works on talos; contract tests pass for 0.19 and 0.21; guard blocks verified live from talos |
 | **P2** digest + context | `/v1/fetch` modes, Dixie digest (thinking on vs off measured), Honcho search context, token metrics | on 50 real fetches: median `returned/raw` ≤ 0.2 with spot-checked quality; p90 latency ≤ 30 s with digest; no guardian-star access possible |
 | **P3** search | `/v2/search` + `/v1/search`: SearXNG + Brave LLM Context, dedupe, honcho-embed rerank | search quality spot-check vs SearXNG alone; cost per query known |