diff --git a/README.md b/README.md
index 5b38b15..a414467 100644
--- a/README.md
+++ b/README.md
@@ -159,7 +159,7 @@ Security note:
 cd awg2_harness
 ./tools/build.sh --prepare-build-env --bootstrap-rust --yes
 ./tools/build.sh --package --version 0.1.6
-sha256sum -c dist/SHA256SUMS
+(cd dist && sha256sum -c SHA256SUMS)
 dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
 dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
 ```
diff --git a/docs/INSTALLATION.md b/docs/INSTALLATION.md
index d4a9d7b..664c098 100644
--- a/docs/INSTALLATION.md
+++ b/docs/INSTALLATION.md
@@ -40,7 +40,7 @@ cargo test --locked --workspace --release --manifest-path Cargo.toml
 
 ```bash
 ./tools/build.sh --package --version 0.1.6
-sha256sum -c dist/SHA256SUMS
+(cd dist && sha256sum -c SHA256SUMS)
 dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
 dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
 ```
@@ -176,6 +176,27 @@ ports={"53/tcp":null,"53/udp":null}
 
 Это означает, что DNS не опубликован на публичном host-интерфейсе и остаётся доступным только через VPN/Docker path.
 
+Negative-check публичного DNS:
+
+```bash
+nslookup example.com <server-public-ip>
+```
+
+Ожидаемое поведение: публичный DNS-запрос **не должен успешно резолвиться**. Типичные безопасные варианты ответа: `connection refused`, `timeout` или `no servers could be reached`.
+
+Optional deep-check DNS path (если нужна углублённая проверка):
+
+```bash
+apt install -y dnsutils
+
+DNS_PID="$(docker inspect -f '{{.State.Pid}}' amnezia-dns)"
+AWG_PID="$(docker inspect -f '{{.State.Pid}}' amnezia-awg2)"
+
+nsenter -t "$DNS_PID" -n ss -lntup
+nsenter -t "$AWG_PID" -n ip route
+nsenter -t "$AWG_PID" -n dig @172.29.172.254 example.com A +short
+```
+
 ## C. Transfer artifacts
 
 Ниже два production-сценария установки.
diff --git a/tools/README.md b/tools/README.md
index 5a0515f..b543e3c 100644
--- a/tools/README.md
+++ b/tools/README.md
@@ -25,7 +25,7 @@ cd awg2_harness
 chmod +x tools/build.sh
 ./tools/build.sh --prepare-build-env --bootstrap-rust --yes
 ./tools/build.sh --package --version 0.1.6
-sha256sum -c dist/SHA256SUMS
+(cd dist && sha256sum -c SHA256SUMS)
 dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
 dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
 ```
@@ -41,7 +41,7 @@ dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
 ## Проверка пакета перед переносом
 
 ```bash
-sha256sum -c dist/SHA256SUMS
+(cd dist && sha256sum -c SHA256SUMS)
 dpkg-deb -I dist/awg2-harness_<version>_amd64.deb
 dpkg-deb -c dist/awg2-harness_<version>_amd64.deb | sort
 ```
diff --git a/tools/build.sh b/tools/build.sh
index e5491a3..ea798b8 100644
--- a/tools/build.sh
+++ b/tools/build.sh
@@ -376,8 +376,11 @@ echo "Create /etc/awg2-harness/config.toml manually before enabling services:"
 echo "  install -d -m 0755 /etc/awg2-harness"
 echo "  cp /usr/share/doc/awg2-harness/repo/config.example.toml /etc/awg2-harness/config.toml"
 echo "  nano /etc/awg2-harness/config.toml"
-echo "Then validate and enable services:"
+echo "Then run preflight before enabling services:"
 echo "  awg2-harness --config /etc/awg2-harness/config.toml validate-config"
+echo "  awg2-harness --config /etc/awg2-harness/config.toml validate-runtime"
+echo "  awg2-harness --config /etc/awg2-harness/config.toml status"
+echo "Enable services only after SSH, Amnezia port and peer CIDR are verified."
 echo "  systemctl enable --now awg2-harness.service awg2-reboot-scheduler.service"
 
 exit 0