diff --git a/SECURITY.md b/SECURITY.md
index 9f961a91..4faec965 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -74,7 +74,8 @@ us beyond the download itself.
   reach its code-signing certificate fails to build rather than falling back to a self-signed one.
   Check with `Get-AuthenticodeSignature punktfunk-host-setup-1.2.3.exe`.
 - **The Windows drivers** (virtual display, virtual gamepads) are signed with a stable self-signed
-  certificate, `CN=punktfunk-driver`, whose fingerprint is published in
+  certificate, `CN=punktfunk-driver`
+  (SHA-1 `4B8493E7CD565758D335F8F4F05C5A7261A13E02`), also published in
   [`packaging/windows/README.md`](packaging/windows/README.md). The installer has to add it to the
   machine's trusted roots for a self-signed driver to install at all, so — unlike the cases above —
   this signature does **not** authenticate the download: it gives the drivers a stable publisher
diff --git a/packaging/windows/README.md b/packaging/windows/README.md
index 70193eed..36102318 100644
--- a/packaging/windows/README.md
+++ b/packaging/windows/README.md
@@ -153,7 +153,15 @@ Our three UMDF drivers are signed with a **stable self-signed code-signing cert*
 is a **hard failure** (`-RequireSignedCert`, default `auto` off `GITHUB_REF`); canary and local
 builds still fall back to a per-build throwaway.
 
-**Current fingerprint (SHA-1 thumbprint):** `<fill in after generating — see below>`
+**Current fingerprint (SHA-1 thumbprint):** `4B8493E7CD565758D335F8F4F05C5A7261A13E02`
+
+Verify a shipped driver against it:
+
+```powershell
+$dll = Get-ChildItem C:\Windows\System32\DriverStore\FileRepository\pf_vdisplay*\pf_vdisplay.dll |
+         Select-Object -First 1 -Expand FullName
+(Get-AuthenticodeSignature $dll).SignerCertificate.Thumbprint
+```
 
 Why stable matters here. The installer trusts the `.cer` that ships in the bundle
 (`certutil -addstore -f Root` + `TrustedPublisher`, `crates/punktfunk-host/src/windows/install.rs`),