diff --git a/docs/04-HARDWARE-INVENTORY.md b/docs/04-HARDWARE-INVENTORY.md
index f420665..6d2f03f 100644
--- a/docs/04-HARDWARE-INVENTORY.md
+++ b/docs/04-HARDWARE-INVENTORY.md
@@ -147,6 +147,27 @@
 |----|---------|
 | 192.168.10.10 | AdGuard Home (macvlan) - DNS Failover |
 
+### HAOS | Home Assistant OS (ASRock Q1900TM-ITX)
+
+| Property | Value |
+|----------|-------|
+| **Role** | Home Automation (bare-metal HAOS) |
+| **IP** | 192.168.10.102 (DHCP reservation) |
+| **MAC** | D0:50:99:47:B6:BF |
+| **OS** | Home Assistant OS 18.1 (Core 2026.7.4) |
+| **CPU** | Intel Celeron J1900 (quad-core) |
+| **RAM** | 16 GB |
+| **Storage** | 128 GB mSATA (HAOS); 512 GB SSD unused |
+| **Switch Port** | CSS326 Port 3 (VLAN 10 Mgmt) |
+| **URL** | https://ha.xtrm-lab.org |
+| **SSH** | `ssh hassio@192.168.10.102` (Advanced SSH add-on, key auth) |
+
+**Notes:**
+- Installed 2026-07-28 (bare-metal). UEFI boot from the internal mSATA required a manual `efibootmgr` NVRAM entry (`\EFI\BOOT\BOOTX64.EFI`) — ASRock Q1900 firmware will not auto-create a UEFI boot entry for a fixed SATA disk (boots from USB only). Booted a SystemRescue USB in UEFI mode and ran `efibootmgr -c -d /dev/sda -p 1 -L "HAOS" -l '\EFI\BOOT\BOOTX64.EFI'`.
+- Network: was silent on the CSS326 Kids port (Port 18, VLAN 25 — that VLAN is not trunked to the router). Moved to Port 3 (VLAN 10) → got DHCP immediately.
+- Reverse proxy: Traefik `ha.xtrm-lab.org` → `192.168.10.102:8123`; HA `http.trusted_proxies` = `192.168.10.20`, `172.18.0.0/16` (required — new HA returns HTTP 400 to proxied requests otherwise).
+- Old HA VM (`192.168.10.20:8123`) kept as fallback, now reachable by IP only.
+
 ---
 
 ## Patch Panels
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index eb6d150..1087d12 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -2,6 +2,17 @@
 
 **Purpose:** Major infrastructure events only. Minor changes are in git commit messages.
 
+---
+## 2026-07-28
+
+### Home Assistant OS on bare-metal (ASRock Q1900TM-ITX)
+- **[HARDWARE]** New HAOS box: ASRock Q1900TM-ITX (J1900, 16 GB RAM, 128 GB mSATA). HAOS 18.1 / Core 2026.7.4. IP `192.168.10.102` (DHCP reservation, MAC D0:50:99:47:B6:BF), CSS326 Port 3 (VLAN 10).
+- **[BOOT]** ASRock Q1900 will not UEFI-boot a fixed SATA disk (boots USB only) — fixed with a manual `efibootmgr` NVRAM entry to `\EFI\BOOT\BOOTX64.EFI` from a SystemRescue live USB.
+- **[NETWORK]** No DHCP on CSS326 Kids port (Port 18, VLAN 25 not trunked to router); moved to Port 3 (VLAN 10) → immediate lease.
+- **[TRAEFIK]** Repointed `ha.xtrm-lab.org` service `192.168.10.20:8123` → `192.168.10.102:8123` (dynamic/services.yml, backup kept). Added HA `http.trusted_proxies` (192.168.10.20, 172.18.0.0/16) — required or new HA returns HTTP 400 behind the proxy.
+- **[SSH]** Installed Advanced SSH & Web Terminal add-on (key auth, protection mode off) → `ssh hassio@192.168.10.102`.
+- **[NOTE]** Old HA VM (`192.168.10.20:8123`) kept as fallback, now reachable by IP only.
+
 ---
 ## 2026-07-08