diff --git a/scripts/smoke/README.md b/scripts/smoke/README.md
index c709b32..4d15cfb 100644
--- a/scripts/smoke/README.md
+++ b/scripts/smoke/README.md
@@ -2,6 +2,20 @@
 
 This smoke path is for proving the minimal end-to-end server-side session lifecycle without any UI.
 
+## VPN Runtime CI Guards
+
+Fast one-shot validation for `agents/rap-node-agent/internal/vpnruntime`:
+
+```powershell
+pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1 -AntiFlakeCount 20 -TargetedCount 50
+```
+
+Windows `cmd` wrapper:
+
+```cmd
+scripts\smoke\run-vpnruntime-ci-guards.cmd
+```
+
 ## Verification matrix
 
 ### Locally proven in this repository work
@@ -594,4 +608,4 @@ Remaining manual live proof:
 - verify `bidirectional` allows upload and download
 - verify rendering, mouse, keyboard, clipboard, upload, reconnect, takeover,
   and backend gateway fallback do not regress
-
+