diff --git a/docs/release_notes/v0.1.0.md b/docs/release_notes/v0.1.0.md
index 2eb9ec6..0a38547 100644
--- a/docs/release_notes/v0.1.0.md
+++ b/docs/release_notes/v0.1.0.md
@@ -37,12 +37,28 @@ been evaluated, and the test split has not been read
     reviews kept.
 - **Not measured:** the 2 vCPU / 4 GB target-host benchmarks.
 
+## Model bundle
+
+`crf-batches-01-02.tgz` (attached to the release) holds the bundle directory
+`crf-batches-01-02/`, with `tagger.crfsuite`, `classifiers.joblib` and `metadata.json`.
+- **Archive SHA-256:** `65677a7413e02a8da4ba3b920ac7eb8e02a8cba874876d93810d4ae5fc76d29a`.
+- **Bundle weights digest:** `d1f8cb5a…07056`, which `release.json` records and the app checks
+  at start-up.
+- **Trust:** `classifiers.joblib` is a pickle, so load it only from this release, after
+  checking the SHA-256.
+- **License:** the CRF's feature vocabulary is derived from GitHub Advisory Database text and
+  the TriggerMap annotations (CC BY 4.0, modified). Attribution and licence details are in
+  [`annotations/README.md`](../../annotations/README.md).
+
 ## Deploying it
 
 Follow [`docs/deployment.md`](../deployment.md) with the image digest from
 `release-image.json`:
 
 ```bash
+gh release download v0.1.0 --pattern crf-batches-01-02.tgz
+shasum -a 256 crf-batches-01-02.tgz      # must match the SHA-256 above
+tar -xzf crf-batches-01-02.tgz
 uv run triggermap release create v0.1.0 --image ghcr.io/professor3333/triggermap@sha256:<digest> \
-    --model crf --model-dir <crf-batches-01-02 bundle>
+    --model crf --model-dir crf-batches-01-02
 ```