diff --git a/README.md b/README.md
index 40415dc..9618b05 100644
--- a/README.md
+++ b/README.md
@@ -29,6 +29,66 @@ Expect **10–20 minutes**: atuin, eza, macchina and oxker are built from source
 trade for matching the currently-running versions exactly rather than taking
 whatever apt ships.
 
+## What gets installed
+
+Everything `setup.sh` puts on the box, and where it comes from.
+
+### apt packages
+
+| Package | What for | Upstream |
+|---|---|---|
+| `fish` | the shell itself; `setup.sh` `chsh`es to it | [fish-shell/fish-shell](https://github.com/fish-shell/fish-shell) |
+| `bat` | binary is **`batcat`** on Ubuntu; `config.fish` aliases `cat` to it | [sharkdp/bat](https://github.com/sharkdp/bat) |
+| `ripgrep` | `rg` | [BurntSushi/ripgrep](https://github.com/BurntSushi/ripgrep) |
+| `jq` | required by `statusline-command.sh` | [jqlang/jq](https://github.com/jqlang/jq) |
+| `git` | chezmoi clones the source repo with it | [git/git](https://github.com/git/git) |
+| `curl` | fetches the rustup / starship / chezmoi installers | [curl/curl](https://github.com/curl/curl) |
+| `nano` | `$EDITOR`; the `nanox` alias forces `TERM=xterm-256color` under Ghostty | [nano-editor.org](https://www.nano-editor.org/) |
+| `build-essential` | cc/linker — cargo builds need it | [GNU GCC](https://gcc.gnu.org/) |
+| `pkg-config` | build dep for the cargo tools | [pkg-config](https://gitlab.freedesktop.org/pkg-config/pkg-config) |
+| `libssl-dev` | OpenSSL headers — atuin links against them | [openssl/openssl](https://github.com/openssl/openssl) |
+
+The last three exist only to compile the cargo tools below. Nothing uses them at
+runtime.
+
+### Built from source with `cargo install --locked`
+
+| Tool | What for | Upstream |
+|---|---|---|
+| `atuin` | shell history w/ sync + encryption | [atuinsh/atuin](https://github.com/atuinsh/atuin) |
+| `eza` | `ls` replacement; backs the `l` / `ll` / `lt` / `la` aliases | [eza-community/eza](https://github.com/eza-community/eza) |
+| `macchina` | the banner `config.fish` prints on interactive start | [Macchina-CLI/macchina](https://github.com/Macchina-CLI/macchina) |
+| `oxker` | terminal Docker container UI | [mrjackwills/oxker](https://github.com/mrjackwills/oxker) |
+
+This is the slow part — **10–20 minutes cold**. Built from source deliberately, to
+match the versions running on the origin box rather than whatever apt ships. That
+makes the rust toolchain a mandatory build dependency:
+
+| Tool | What for | Upstream |
+|---|---|---|
+| `rustup` + cargo | toolchain for the four tools above | [rust-lang/rustup](https://github.com/rust-lang/rustup) |
+
+Installed via `sh.rustup.rs` with `--no-modify-path` — `conf.d/rustup.fish`
+already sources `~/.cargo/env.fish`, and the installer would otherwise add a
+second PATH edit. Lands in `~/.cargo`, owned by the user, not root.
+
+### Installed via upstream install scripts
+
+| Tool | Where it lands | Upstream |
+|---|---|---|
+| `starship` | `/usr/local/bin` (root) | [starship/starship](https://github.com/starship/starship) |
+| `chezmoi` | `~/.local/bin` (user) | [twpayne/chezmoi](https://github.com/twpayne/chezmoi) |
+
+Both are `curl … | sh` from the projects' own domains (`starship.rs`,
+`get.chezmoi.io`).
+
+### Not installed here
+
+`fnm` (node) and `dtop`/opencode are out of scope — their own installers write
+`conf.d/fnm.fish` and `conf.d/dtop.env.fish`, which are `.chezmoiignore`d.
+`config.fish` adds `~/.opencode/bin` to `PATH` only if that directory already
+exists.
+
 ## chezmoi on another VPS
 
 `setup.sh` already does all of this. Use this path only when you want the dotfiles