diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index ce67b63..c02c084 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -36,6 +36,8 @@ The organization installation created on 2026-10-20 has App ID `5402066`, slug `
 
 Create a second organization-owned GitHub App named **Tank Royale Rumble Publisher** using the [pre-filled registration form](https://github.com/organizations/robocode-dev/settings/apps/new?name=Tank%20Royale%20Rumble%20Publisher&description=Opens%20generated%20Rumble%20catalog%20pull%20requests%20after%20a%20bot%20submission%20is%20merged.&url=https%3A%2F%2Fgithub.com%2Frobocode-dev%2Frumble-bots&public=false&request_oauth_on_install=false&webhook_active=false&contents=read&pull_requests=write). Check that its description is `Opens generated Rumble catalog pull requests after a bot submission is merged.` and its homepage is `https://github.com/robocode-dev/rumble-bots`. Leave callback and setup URLs empty, disable user authorization, device flow and webhooks, subscribe to no events, set installation to **Only on this account**, and install it with **Only select repositories → `robocode-dev/rumble-bots`**. Grant repository **Contents: Read** and **Pull requests: Read & write** only; leave all other permissions at their defaults. The expected slug is `tank-royale-rumble-publisher`, whose bot account opens catalog PRs. It cannot push catalog files, set moderation statuses or bypass branch rules, and the workflow never uses it to approve a review. The existing moderator App pushes the generated branch, verifies its exact content in a separate workflow, and approves and merges the Publisher App's PR.
 
+Upload the [publisher App avatar](assets/tank-royale-rumble-publisher-avatar.png) under the App's display settings. This square transparent PNG matches the moderator App's visual style and is under GitHub's 1 MB upload limit.
+
 Generate a private key and save the Publisher App ID as `RUMBLE_PUBLISHER_APP_ID` and its full PEM contents as `RUMBLE_PUBLISHER_PRIVATE_KEY` in this repository's Actions secrets. Never commit the PEM file. Delete the downloaded local copy after securely storing the key, and rotate it in the App settings when needed.
 
 ## GitHub Actions permissions
diff --git a/assets/tank-royale-rumble-publisher-avatar.png b/assets/tank-royale-rumble-publisher-avatar.png
new file mode 100644
index 0000000..5770e04
Binary files /dev/null and b/assets/tank-royale-rumble-publisher-avatar.png differ