diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cb4d0e1..349d06b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,7 +5,9 @@ are `bakery` (the ecosystem package manager) and `bread-theme` (the shared
 theming crate). Shared crates that sibling apps pin — not bakery packages
 of their own — are `bread-utils`, `bread-app`, `bread-onnx`,
 `bread-screenshots`, and `bread-capture`. `bread-polkit` is an in-tree
-session agent, also not a bakery product. Other ecosystem products
+session agent: it has `bread-polkit/bakery.toml` so it *can* be published,
+but it is not in `registry/bread-ecosystem.toml` (unpublished — not on
+the bakery index, not on the BOS ISO). Other ecosystem products
 (`bread`, `breadbar`, `breadbox`, …) live in their own repos under
 `Breadway/` but follow the same workflow described here. The product list
 is `registry/bread-ecosystem.toml`. New GTK tools should depend on
diff --git a/README.md b/README.md
index 34ccf27..927c629 100644
--- a/README.md
+++ b/README.md
@@ -153,7 +153,7 @@ bread-ecosystem/
 ├── bread-theme/         # shared pywal + fixed-dark-base theming crate
 ├── bread-utils/         # shared plumbing (Hyprland IPC, singleton, XDG, BreadClient, …)
 ├── bread-app/           # GTK bootstrap new tools should use (app id, singleton, overlay, command listen)
-├── bread-polkit/        # themed PolicyKit authentication agent (not a bakery product)
+├── bread-polkit/        # themed PolicyKit agent (bakery.toml present; unpublished)
 ├── bread-onnx/          # shared ONNX runtime helpers
 ├── bread-screenshots/   # grim capture primitive used by app `--screenshot` modes
 ├── bread-capture/       # orchestrator that drives those `--screenshot` modes
@@ -179,8 +179,10 @@ tree; `bread-polkit` is the first in-tree consumer.
 ### bread-polkit
 
 A session PolicyKit authentication agent (password prompt, cancel,
-identity). Not a wrapper around `polkit-gnome`. Not published via bakery
-and not on the BOS ISO lockfile.
+identity). Not a wrapper around `polkit-gnome`. `bread-polkit/bakery.toml`
+exists so it can be published via bakery; it is not in
+`registry/bread-ecosystem.toml` and is therefore unpublished — not on the
+bakery index and not on the BOS ISO lockfile.
 
 ```sh
 cargo run -p bread-polkit
diff --git a/bread-polkit/bakery.toml b/bread-polkit/bakery.toml
new file mode 100644
index 0000000..4dd8e44
--- /dev/null
+++ b/bread-polkit/bakery.toml
@@ -0,0 +1,11 @@
+name = "bread-polkit"
+description = "Themed PolicyKit authentication agent for the bread desktop"
+binaries = ["bread-polkit"]
+system_deps = ["gtk4", "gtk4-layer-shell", "polkit"]
+optional_system_deps = ["hyprland"]
+bread_deps = []
+license_file = "LICENSE"
+desktop_file = "bread-polkit.desktop"
+
+[install]
+post_install = []