diff --git a/docs/changelog.md b/docs/changelog.md
new file mode 100644
index 0000000..d3749c0
--- /dev/null
+++ b/docs/changelog.md
@@ -0,0 +1,36 @@
+# Changelog
+
+## 2026-07-19
+
+### Standalone installation and deployment
+
+- Added `rsmon-worker install` for installing the current binary, a mode-0600
+  environment file, and a root-owned systemd service.
+- Added `rsmon-worker deploy` for installing workers over SSH with key or
+  password authentication, optional secret files, and host-key verification
+  through `known_hosts` or a pinned fingerprint.
+- Added `--token-file`, `--url`, `--api-key`, and `--no-start` deployment
+  options.
+- Added optional `--docker` deployment using the prebuilt
+  `reg.rsxx.ru/rsmon/rsmon-worker:latest` image. Remote Docker deployment pulls
+  the image on the target host and does not depend on the local architecture.
+- Simplified the default systemd service to `Type=simple`, `User=root`, and
+  `Restart=on-failure`.
+- Reworked the legacy `scripts/install-systemd.sh` script as a compatibility
+  wrapper around the built-in installer.
+
+### Standalone repository cleanup
+
+- Removed the remaining certificate-bundle fallback under `/data/rsmon` and
+  updated its documentation.
+- Changed Docker build and runtime bases to public Go and Debian images.
+- Documented binary, systemd, Docker, and SSH deployment workflows.
+- Added installer and SSH host-verification tests.
+
+### Verification
+
+- Passed `make test`, `make build`, `go vet`, and `go mod verify`.
+- Validated systemd units, Compose configuration, Docker image pull and
+  execution, and production worker job reporting.
+- Published the changes as commit `3256dcd` (`feat: add worker install and
+  deploy`) on `master`, triggering the Docker image workflow.
diff --git a/docs/sessions/2026-07-19-standalone-deployment.md b/docs/sessions/2026-07-19-standalone-deployment.md
new file mode 100644
index 0000000..361ac3d
--- /dev/null
+++ b/docs/sessions/2026-07-19-standalone-deployment.md
@@ -0,0 +1,57 @@
+# Session: Standalone Worker Deployment
+
+Date: 2026-07-19
+
+## Goal
+
+Make `rsmon-worker` independently installable and deployable without requiring
+the main `rsmon` repository. Keep direct binary plus systemd installation as the
+default and offer the prebuilt Docker image as an explicit alternative.
+
+## Completed
+
+- Audited build and runtime paths for dependencies on `/data/_devops/rsmon` and
+  `/data/rsmon`.
+- Removed the obsolete local certificate-bundle fallback.
+- Switched the Dockerfile to public `golang:1-trixie` and `debian:13-slim`
+  bases.
+- Implemented local binary and Docker installation in `internal/installer`.
+- Implemented SSH deployment with key, password, passphrase, known-hosts, and
+  fingerprint support.
+- Added `install` and `deploy` command handling and secret-file options to the
+  CLI.
+- Added and updated installer tests, systemd packaging, deployment docs, and
+  the legacy installation wrapper.
+- Reviewed the implementation for release blockers and secret exposure.
+- Committed and pushed the work to `origin/master` as `3256dcd`.
+
+## Decisions
+
+- The default service uses `Type=simple`, runs as `root`, and restarts only on
+  failure.
+- Docker deployment pulls `reg.rsxx.ru/rsmon/rsmon-worker:latest` on the target
+  host instead of uploading a local image or binary.
+- The existing source-available license remains unchanged until public-release
+  licensing is decided.
+- Worker credentials are supplied at deployment time and are not stored in the
+  repository.
+
+## Verification
+
+- `make test`
+- `make build`
+- `go vet ./cmd/rsmon-worker ./internal/installer`
+- `go mod verify`
+- Docker image pull and `--version` execution
+- Compose configuration with a temporary environment fixture
+- Live WebSocket connection, configuration receipt, job execution, and result
+  reporting
+
+## Operational State
+
+- A local worker was left running as `./bin/rsmon-worker --no-web`, PID
+  `211207`, with logs in `/tmp/rsmon-worker-local.log`.
+- The worker received configuration as worker ID `test` and continued reporting
+  results after automatic reconnections caused by periodic WebSocket EOFs.
+- Pushing `master` triggered `.github/workflows/docker.yml`; workflow completion
+  was not checked during the session.