diff --git a/README.md b/README.md
index 586fe13..c5c0072 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,8 @@ nix build -f . deploy.$hostname && ./result switch
 `$hostname` can be replaced with any hostname or group
 
 ## committing to haccfiles
+- Golden Rule: DO NOT COMMIT TO MAIN
+  - exceptions apply, if you are not sure where to commit, don't commit to main
 - split up commits, every commit is one atomic change
   - e.g. no big "did some changes" but instead "updated service x", "updated service y", "update service z"
 - follow the commit format: "$prefix$place: $change"