diff --git a/CHANGELOG.md b/CHANGELOG.md
index 846df76..12582d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## Unreleased
+
+- The gemspec sets `rubygems_mfa_required`, so a push with someone's RubyGems
+  credentials is refused without a second factor. Releases already go through
+  trusted publishing, which needs no stored key; this closes the other door.
+- Added `bug_tracker_uri` and `documentation_uri` to the gemspec metadata, so
+  the RubyGems page links to the issue tracker and the README.
+
 ## 0.1.0 - 2026-09-18
 
 Provider-neutral release. One `Client`, two providers behind it.
diff --git a/ruby_decision_model.gemspec b/ruby_decision_model.gemspec
index aa567ed..b019c27 100644
--- a/ruby_decision_model.gemspec
+++ b/ruby_decision_model.gemspec
@@ -19,8 +19,16 @@ Gem::Specification.new do |spec|
   spec.license = "MIT"
   spec.required_ruby_version = ">= 3.2"
 
+  # homepage_uri is left out on purpose: it would duplicate source_code_uri,
+  # and `gem build --strict` in the release workflow fails on that warning.
   spec.metadata["source_code_uri"] = spec.homepage
   spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
+  spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues"
+  spec.metadata["documentation_uri"] = "#{spec.homepage}/blob/main/README.md"
+  # Releases go through trusted publishing, which needs no stored key. This
+  # closes the other door: a push with someone's RubyGems credentials, from a
+  # laptop or a leaked token, is refused without a second factor.
+  spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.files = Dir["lib/**/*.rb"] + %w[README.md CHANGELOG.md LICENSE.txt]
   spec.require_paths = ["lib"]