diff --git a/.werkator.yml b/.werkator.yml
new file mode 100644
index 0000000..aeebab3
--- /dev/null
+++ b/.werkator.yml
@@ -0,0 +1,35 @@
+# Werkator CI configuration for Werkdock (built by https://werkator.javagil.de).
+# Reference: https://github.com/mhoennig/werkator/blob/main/docs/configuration.md
+#
+# Werkdock lived in the Werkator repository until the extraction (plan step 21,
+# session E); its build definition moved here unchanged, minus the werkdock/
+# path prefix it needed as a subdirectory.
+werkator:
+  version:
+    since: "1.0.1"
+
+gitea:
+  baseUrl: https://git.javagil.de
+  owner: mi
+  repo: werkdock
+  statusContext: werkator
+
+artifacts:
+  retentionPerBranch: 3
+
+watcher:
+  newBranchMaxAge: 5d
+
+builds:
+  # One build: the Go module at the repository root. The first gofmt call
+  # prints any unformatted files, the second fails the build on them.
+  # Needs the go toolchain in the build environment.
+  default:
+    trigger:
+      onPush: true
+    cleanCommand: rm -rf dist
+    buildCommand: gofmt -l . && test -z "$(gofmt -l .)" && go vet ./... && go test ./... && CGO_ENABLED=0 go build -o dist/werkdock .
+    artifactDirs:
+      - dist
+    stdoutLog: build.stdout.log
+    stderrLog: build.stderr.log
diff --git a/README.md b/README.md
index fc220d5..30085f6 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,9 @@ werkdock run --rm -v /repo:/repo -w /repo IMAGE sh -c './gradlew build'
 
 Status: bootstrap.
 The implementation language is Go, decided in [RFC 0001](docs/rfcs/0001-implementation-language.md).
-Werkdock grows in this subdirectory of the Werkator repository and moves to its own repository once it stands on its own.
-It must stay self-contained: no imports from Werkator code, no Gradle coupling to the Werkator build.
-The roadmap is session B of [docs/plan/21-werkdock-extraction-and-webspace-install.md](../docs/plan/21-werkdock-extraction-and-webspace-install.md).
+Werkdock grew in the `werkdock/` subdirectory of the [Werkator](https://github.com/mhoennig/werkator) repository and
+moved here once it stood on its own (Werkator plan step 21, session E); the history above the split is preserved.
+It stays self-contained: no imports from Werkator code, no coupling to the Werkator build — Werkator consumes the
+binary through `PATH` (`bwrap.werkdock`), the way it consumes `git`.
+Its own CI is the `.werkator.yml` in this repository; the roadmap that created it is session B of Werkator's
+[plan step 21](https://github.com/mhoennig/werkator/blob/main/docs/plan/21-werkdock-extraction-and-webspace-install.md).