diff --git a/assets/code_example/docs/core/configuration/relativepaths.yaml b/assets/code_example/docs/core/configuration/relativepaths.yaml
new file mode 100644
index 000000000..10cfc7667
--- /dev/null
+++ b/assets/code_example/docs/core/configuration/relativepaths.yaml
@@ -0,0 +1,22 @@
+name: Keep the chart image tag in sync
+
+options:
+  # "Chart.yaml" and "values.yaml" below are looked up next to this manifest,
+  # whatever directory updatecli was started from.
+  relativepaths: manifest
+
+sources:
+  version:
+    name: Read the chart version
+    kind: yaml
+    spec:
+      file: Chart.yaml
+      key: $.version
+
+targets:
+  tag:
+    name: Report it as the image tag
+    kind: yaml
+    spec:
+      file: values.yaml
+      key: $.image.tag
diff --git a/assets/code_example/docs/udash/dashboards/updatecli-compose.yaml b/assets/code_example/docs/udash/dashboards/updatecli-compose.yaml
new file mode 100644
index 000000000..3a6bae7fe
--- /dev/null
+++ b/assets/code_example/docs/udash/dashboards/updatecli-compose.yaml
@@ -0,0 +1,5 @@
+policies:
+  - name: Rust dependencies
+    policy: ghcr.io/updatecli/policies/autodiscovery/cargo:0.9.1@sha256:237c49b0541ad1a5ce9bcdfef0a525dd47ff854436dee61985b56f2c981c828d
+    values:
+      - values.yaml
diff --git a/assets/code_example/docs/udash/dashboards/values.yaml b/assets/code_example/docs/udash/dashboards/values.yaml
new file mode 100644
index 000000000..d500b1eac
--- /dev/null
+++ b/assets/code_example/docs/udash/dashboards/values.yaml
@@ -0,0 +1,17 @@
+scm:
+  enabled: true
+  kind: github
+  owner: my-org
+  repository: my-crate
+  branch: main
+
+# Pull request labels, applied on GitHub. Udash never sees these.
+labels:
+  - dependencies
+
+# Pipeline labels, stored with every report and offered by the Udash filters.
+pipeline:
+  labels:
+    ecosystem: cargo
+    policy: autodiscovery
+    team: platform
diff --git a/assets/code_example/docs/udash/quick-start/config.json b/assets/code_example/docs/udash/quick-start/config.json
new file mode 100644
index 000000000..e9ff7d80a
--- /dev/null
+++ b/assets/code_example/docs/udash/quick-start/config.json
@@ -0,0 +1,6 @@
+{
+  "AUTH_ENABLED": false,
+  "API_BASE_URL": "/api",
+  "APP_BASE_PATH": "/",
+  "MAX_HISTORY_DAYS": 30
+}
diff --git a/assets/code_example/docs/udash/quick-start/config.yaml b/assets/code_example/docs/udash/quick-start/config.yaml
new file mode 100644
index 000000000..609720c1e
--- /dev/null
+++ b/assets/code_example/docs/udash/quick-start/config.yaml
@@ -0,0 +1,9 @@
+server:
+  auth:
+    # No authentication: anyone reaching this instance can read and write reports.
+    # Fine on a laptop, never on anything reachable from outside.
+    mode: "none"
+
+database:
+  uri: postgres://udash:password@db:5432/udash?sslmode=disable
+  migrationdisabled: false
diff --git a/assets/code_example/docs/udash/quick-start/docker-compose.yaml b/assets/code_example/docs/udash/quick-start/docker-compose.yaml
new file mode 100644
index 000000000..d787c7dcf
--- /dev/null
+++ b/assets/code_example/docs/udash/quick-start/docker-compose.yaml
@@ -0,0 +1,50 @@
+services:
+  db:
+    image: postgres:18@sha256:5a5a84b19854a9ffaa54082c166ff4ec27473a361e496e5ea167f298f2da9722
+    restart: always
+    environment:
+      - POSTGRES_USER=udash
+      - POSTGRES_PASSWORD=password
+      - POSTGRES_DB=udash
+    expose:
+      - 5432
+
+  server:
+    image: ghcr.io/updatecli/udash:v0.18.2@sha256:899c2e3a7bf8b4aea588ba4ca398ce4ca1626479ab96881aa69ad6a18964fae1
+    command: server start
+    restart: always
+    environment:
+      - GIN_MODE=release
+    volumes:
+      - "./udash/config.yaml:/home/udash/.udash/config.yaml"
+    expose:
+      - 8080
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.server.rule=PathPrefix(`/api/`)"
+      - "traefik.http.routers.server.service=server"
+      - "traefik.http.services.server.loadbalancer.server.port=8080"
+
+  front:
+    image: ghcr.io/updatecli/udash-front:v0.26.0@sha256:21d5c66f6872907f5a83da1a07bde6fa1b46bd74d7e56898b52f0a6b5a8e7654
+    restart: always
+    volumes:
+      - "./udash-front/config.json:/usr/share/nginx/html/config.json"
+    expose:
+      - 80
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.front.rule=PathPrefix(`/`)"
+      - "traefik.http.routers.front.service=front"
+      - "traefik.http.services.front.loadbalancer.server.port=80"
+
+  traefik:
+    image: traefik:v3.7@sha256:24841fe2de7304c149343d877d2923b4c8800a38ba015dea9174c23b20e344a0
+    command:
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+    ports:
+      - "80:80"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
diff --git a/assets/code_example/docs/udash/quick-start/updatecli-compose.yaml b/assets/code_example/docs/udash/quick-start/updatecli-compose.yaml
new file mode 100644
index 000000000..b3caeae62
--- /dev/null
+++ b/assets/code_example/docs/udash/quick-start/updatecli-compose.yaml
@@ -0,0 +1,3 @@
+policies:
+  - name: Discover what could be updated here
+    policy: ghcr.io/updatecli/policies/autodiscovery/all:0.7.0@sha256:09bd79160f4ecda4d8323b25815a733d39334c22544aaa6ac5859f0d3ef9fa79
diff --git a/assets/code_example/docs/udash/sending-reports/updatecli.yaml b/assets/code_example/docs/udash/sending-reports/updatecli.yaml
new file mode 100644
index 000000000..b1c9576f2
--- /dev/null
+++ b/assets/code_example/docs/udash/sending-reports/updatecli.yaml
@@ -0,0 +1,37 @@
+name: Bump the base image
+pipelineid: docker/base-image
+
+labels:
+  ecosystem: docker
+  monitor: active
+
+# The scm files the reports under this Git repository in Udash.
+scms:
+  default:
+    kind: github
+    spec:
+      owner: my-org
+      repository: my-service
+      branch: main
+      token: '{{ requiredEnv "GITHUB_TOKEN" }}'
+
+sources:
+  alpine:
+    name: Get the latest Alpine version
+    kind: dockerimage
+    spec:
+      image: alpine
+      versionfilter:
+        kind: semver
+
+targets:
+  dockerfile:
+    name: Update the Alpine base image
+    kind: dockerfile
+    scmid: default
+    sourceid: alpine
+    spec:
+      file: Dockerfile
+      instruction:
+        keyword: FROM
+        matcher: alpine
diff --git a/config/_default/menus/menus.en.toml b/config/_default/menus/menus.en.toml
index 1ba090411..3bcbaf2d8 100644
--- a/config/_default/menus/menus.en.toml
+++ b/config/_default/menus/menus.en.toml
@@ -32,6 +32,12 @@ weight = 40
 identifier = "guide"
 pageRef = "/docs/guides"
 
+[[sidebar_docs]]
+name = "Udash"
+weight = 45
+identifier = "udash"
+pageRef = "/docs/udash"
+
 [[sidebar_docs]]
 name = "Commands"
 weight = 50
diff --git a/content/en/docs/core/configuration.adoc b/content/en/docs/core/configuration.adoc
index 3f17da6ee..b9625cb37 100644
--- a/content/en/docs/core/configuration.adoc
+++ b/content/en/docs/core/configuration.adoc
@@ -67,6 +67,10 @@ A manifest accepts the following root keys. All of them are optional except `nam
 | string
 | The minimum Updatecli version required by the manifest. Updatecli skips the manifest, with an error, when its own version is lower.
 
+| `options`
+| object
+| Settings changing how Updatecli behaves for this manifest, as opposed to describing the pipeline itself. See <<_options,Options>>.
+
 | `sources`
 | map
 | See link:/docs/core/source/[source].
@@ -147,6 +151,80 @@ This affects manifest execution order only and does not replace `pipelineid`.
 
 To learn more, see **link:/docs/core/order/[manifest order]**.
 
+[#_options]
+=== Options
+
+The `options` root key groups the settings that change how Updatecli behaves for a manifest, as opposed to the keys describing what the pipeline is made of.
+
+[cols="1,1,3",options=header]
+|===
+| Key | Default | Description
+
+| `relativepaths`
+| `workingdirectory`
+| What the relative paths of the manifest resolve against. See <<_relative_paths,Relative paths>>.
+|===
+
+[#_relative_paths]
+==== Relative paths
+
+By default, a relative path written in a manifest resolves against the directory Updatecli was started from, not against the manifest that declares it.
+A manifest stored in `updatecli.d/nodejs.yaml` and asking for `file: package.json` therefore reads the `package.json` of whichever directory you happened to run the command in.
+
+Setting `relativepaths` to `manifest` makes those paths resolve against the directory holding the manifest instead, which is what allows a manifest, or a whole directory of them, to be moved, vendored into another repository, or distributed as a link:/docs/core/shareandreuse/[policy] without rewriting every path.
+
+[cols="1,3",options=header]
+|===
+| Value | Behaviour
+
+| `workingdirectory`
+| Relative paths resolve against the directory Updatecli was started from. This is the default, and the historical behaviour.
+
+| `manifest`
+| Relative paths resolve against the directory holding the manifest that declares them.
+|===
+
+++++
+<details><summary>updatecli.yaml</summary>
+<pre>
+{{<include "assets/code_example/docs/core/configuration/relativepaths.yaml">}}
+</pre>
+</details>
+++++
+
+The setting applies to the manifest that declares it, so a directory of manifests can be migrated one file at a time.
+It can also be set for a whole run, with the `--relative-paths` flag or the `UPDATECLI_RELATIVE_PATHS` environment variable, which is the practical way to try it on an existing repository:
+
+[source,shell]
+----
+updatecli diff --relative-paths manifest --config updatecli.d
+----
+
+A manifest declaring `options.relativepaths` wins over the flag and the environment variable.
+
+[IMPORTANT]
+====
+`relativepaths` only affects resources that are **not** attached to an link:/docs/core/scm/[scm].
+
+A source, condition, or target with an `scmid` always resolves its paths against the working directory of that scm, which is the clone Updatecli made for it. That is unchanged, and is what makes a target committed to the right repository.
+====
+
+Within a manifest that sets `relativepaths: manifest`, the manifest directory becomes the base for:
+
+* the file paths of every resource without an `scmid`, such as `spec.file` and `spec.files`
+* the working directory of the link:/docs/plugins/resource/shell/[shell] resource, `spec.workdir`
+* a relative `directory` in an `scms` entry, and the repository the `local` scm auto-detects
+* the directory the link:/docs/core/autodiscovery/[autodiscovery] crawlers scan
+
+Absolute paths are never rewritten, and `http://` or `https://` locations are always fetched over the network rather than read from disk.
+
+NOTE: The values, secrets, and manifest files passed on the command line with `--values`, `--secrets`, and `--config` are resolved against the directory Updatecli was started from, whatever `relativepaths` says. They are arguments to the command, not content of a manifest.
+
+[TIP]
+====
+The default stays `workingdirectory` on purpose. The most common layout is a `updatecli.d/` directory whose manifests reference paths from the root of the repository, and those manifests only work because paths resolve against the working directory. Changing the default would break them, so opting in per manifest is the supported path.
+====
+
 === File
 
 Each Updatecli pipeline is defined in its own manifest file.
diff --git a/content/en/docs/core/label.adoc b/content/en/docs/core/label.adoc
index ae9147305..d29743f19 100644
--- a/content/en/docs/core/label.adoc
+++ b/content/en/docs/core/label.adoc
@@ -49,7 +49,7 @@ updatecli compose apply --labels="ecosystem:go"
 +
 Pipelines matching the filter will execute. Pipelines without the label or with a different value will be skipped.
 
-2. **Filtering pipeline reports** in link:https://github.com/updatecli/udash/[Udash]
+2. **Filtering pipeline reports** in link:/docs/udash/[Udash], where labels group pipelines from many repositories into one view. See link:/docs/udash/dashboards/#_filtering_by_label[Filtering by label].
 
 == Filtering with `--labels`
 
diff --git a/content/en/docs/core/scm.adoc b/content/en/docs/core/scm.adoc
index f2b2b2c89..39e938802 100644
--- a/content/en/docs/core/scm.adoc
+++ b/content/en/docs/core/scm.adoc
@@ -28,7 +28,8 @@ current working directory, and a target that changes a file there gets its chang
 to a branch named after the pipeline `pipelineid`.
 
 A resource without an `scmid` simply works on the current working directory, and Updatecli neither
-clones nor commits anything for it.
+clones nor commits anything for it. A manifest can ask for its own directory to be used instead, with
+link:/docs/core/configuration/#_relative_paths[`options.relativepaths`].
 
 === The `local` scm
 
diff --git a/content/en/docs/help/environment.adoc b/content/en/docs/help/environment.adoc
index 42342d1c0..965be3a77 100644
--- a/content/en/docs/help/environment.adoc
+++ b/content/en/docs/help/environment.adoc
@@ -107,11 +107,12 @@ fails with `you cannot use both token and app authentication methods`.
 |===
 
 NOTE: Reporting to Udash requires `--experimental`. Without it the step is skipped silently, whatever
-these variables say. See link:/docs/help/experimental/["Experimental features" page].
+these variables say. See link:/docs/help/experimental/["Experimental features" page] and
+link:/docs/udash/sending-reports/["Sending reports"].
 
 == Flag defaults
 
-Two flags read a default from the environment, which is the practical way to set them once for a whole
+These flags read a default from the environment, which is the practical way to set them once for a whole
 CI job rather than on every invocation. An unparsable value is ignored and logged at debug level.
 
 [cols="1,1,2", options="header"]
@@ -125,6 +126,12 @@ CI job rather than on every invocation. An unparsable value is ignored and logge
 | `UPDATECLI_DISABLE_VERSION_CHECK`
 | `--disable-version-check`
 | Skip the check for a newer Updatecli release, which runs after the command completes.
+
+| `UPDATECLI_RELATIVE_PATHS`
+| `--relative-paths`
+| What the relative paths of a manifest resolve against, `workingdirectory` (the default) or
+`manifest`. A manifest setting `options.relativepaths` itself wins over this. See
+link:/docs/core/configuration/#_relative_paths["Relative paths"].
 |===
 
 == The `local` scm
diff --git a/content/en/docs/help/experimental.adoc b/content/en/docs/help/experimental.adoc
index 4cdf99fff..a0344a177 100644
--- a/content/en/docs/help/experimental.adoc
+++ b/content/en/docs/help/experimental.adoc
@@ -52,12 +52,14 @@ set.
 
 === Reporting to Udash
 
-link:https://github.com/updatecli/udash[Udash] collects pipeline results for viewing over time.
+link:/docs/udash/[Udash] collects pipeline results for viewing over time.
 
 Without the flag, publishing is skipped **silently**, no warning, no error, and the run reports
 success. Configuring `UPDATECLI_UDASH_*` or running `updatecli udash login` is not enough on its own.
 With the flag, results are published under a section headed `Udash - Experimental`.
 
+See link:/docs/udash/sending-reports/["Sending reports"] for how to configure the endpoint.
+
 `--disable-udash-report` switches it off again without dropping the rest of the flag.
 
 === WebAssembly autodiscovery plugins
diff --git a/content/en/docs/udash/_index.md b/content/en/docs/udash/_index.md
new file mode 100644
index 000000000..e6dc6226b
--- /dev/null
+++ b/content/en/docs/udash/_index.md
@@ -0,0 +1,30 @@
+---
+title: "Udash"
+description: "Publish your Updatecli pipeline reports to Udash, the Updatecli dashboard, and follow update activity across every repository."
+lead: ""
+date: 2026-08-07T10:00:00+02:00
+lastmod: 2026-09-24T10:00:00+02:00
+draft: false
+images: []
+sidebar:
+  collapsed: true
+---
+
+Updatecli tells you what changed on one run, in one repository. [Udash](https://github.com/updatecli/udash)
+keeps those runs, so you can see the same information across every repository and over time.
+
+To see it in use, browse [updatecli.uda.sh](https://updatecli.uda.sh), the public instance the
+Updatecli project publishes its own pipeline reports to.
+
+{{< alert icon="⚠️" text="Udash is experimental, and so is the Updatecli side of it. Publishing reports requires the <code>--experimental</code> flag, and both the API and the interface can change without going through the usual deprecation cycle." >}}
+
+- [Introduction](/docs/udash/introduction/) - what Udash is and how Updatecli feeds it.
+- [Quick start](/docs/udash/quick-start/) - run Udash locally with Docker Compose and publish your
+  first report.
+- [Sending reports](/docs/udash/sending-reports/) - connect Updatecli to an instance, locally or
+  from CI.
+- [Dashboards](/docs/udash/dashboards/) - find your pipelines, filter them with labels, and share a
+  view.
+
+Deploying, configuring, and securing a Udash instance, the agent, and the API are documented in the
+[updatecli/udash](https://github.com/updatecli/udash) repository.
diff --git a/content/en/docs/udash/dashboards.adoc b/content/en/docs/udash/dashboards.adoc
new file mode 100644
index 000000000..3299cbfe6
--- /dev/null
+++ b/content/en/docs/udash/dashboards.adoc
@@ -0,0 +1,170 @@
+---
+title: "Dashboards"
+description: "Find your pipelines in Udash, group them with labels, and share a filtered view as a link."
+lead: "Finding things in the interface"
+date: 2026-08-07T10:00:00+02:00
+lastmod: 2026-09-24T10:00:00+02:00
+draft: false
+images: []
+menu:
+  docs:
+    parent: "udash"
+weight: 40
+toc: true
+---
+// <!-- Required for asciidoctor -->
+:toc:
+// Set toclevels to be at least your hugo [markup.tableOfContents.endLevel] config key
+:toclevels: 4
+
+== Description
+
+Udash has three main screens: the reports list, a single report, and the Git dashboard. Labels
+from your Updatecli manifests drive the filters on all of them. You can try every screen described
+here on link:https://updatecli.uda.sh[updatecli.uda.sh], the public instance the Updatecli project
+publishes to.
+
+The home page also has a *Get Started* panel with the commands to connect Updatecli to this
+instance, filled in with its own URLs. Send that page to a colleague you are onboarding.
+
+== Reports
+
+At `/pipeline/reports`, the reports for one Git repository and branch, with a summary of their
+latest status.
+
+[cols="1,3", options="header"]
+|===
+| Filter | What it does
+
+| Git repository and branch
+| Narrows to one repository, and optionally one branch. Only pipelines with an `scm` are listed.
+
+| Labels
+| Key and value pairs. See <<_filtering_by_label,Filtering by label>>.
+
+| Pipeline result
+| Success, Changed, Failed, or Skipped. Empty means all of them.
+
+| Open pull request
+| Whether the pipeline left a pull request open. A successful pipeline can still be waiting on a
+pull request nobody merged.
+
+| Date range
+| Opens on the most recent day. Widen it to look further back.
+|===
+
+[TIP]
+====
+`⚠` means Updatecli *applied a change*, not that something went wrong. `✔` means there was nothing
+to do.
+====
+
+== A single report
+
+At `/pipeline/reports/<id>`, the full run: its sources, conditions, targets, and actions with the
+configuration each one ran with, the changelog Updatecli retrieved, and the console output. This
+is the page Updatecli links to at the end of a run.
+
+== Git dashboard
+
+At `/scm/dashboard`, the status of every Git repository and branch at once, which answers "how up
+to date is this codebase". A label filter here turns it into a dashboard for one team or one
+ecosystem across the whole organisation.
+
+Only pipelines with an `scm` appear here.
+
+== Filtering by label
+
+Udash has no saved dashboards or groups. A group of pipelines is whatever a label filter selects,
+and the labels come from your manifests.
+
+[cols="1,3", options="header"]
+|===
+| Filter | Selects
+
+| A key and a value
+| Pipelines whose label has exactly that value. Case matters.
+
+| A key with no value
+| Pipelines that carry the key, whatever its value.
+
+| Several rows
+| Pipelines matching all of them.
+|===
+
+There is no OR, so "every `docker` or `helm` pipeline" cannot be one view. The rules match the
+link:/docs/core/label/[`--labels` flag] of Updatecli.
+
+=== Choosing labels
+
+Start from the views you want, and give each question its own key:
+
+[cols="2,2", options="header"]
+|===
+| View you want | Label that produces it
+
+| Everything the platform team owns
+| `team: platform`
+
+| Every container image, in every repository
+| `ecosystem: docker`
+
+| The pipelines that must never fall behind
+| `monitor: active`
+
+| The platform team's patch updates
+| `team: platform` and `update.channel: patch`
+|===
+
+Separate keys can be combined into narrower views later. A single `group: platform-docker` label
+cannot be split back into a team and an ecosystem.
+
+Keep the values few and stable. A label holding a version number or a file path fills the filter
+with values nobody picks.
+
+These keys come from the link:/docs/core/label/#_suggested_vocabulary[suggested vocabulary]. It is a
+recommendation, and neither Updatecli nor Udash validates labels. Following it helps pipelines
+written by different people line up under the same filter.
+
+=== Labels on pipelines you do not write
+
+Labels on an `autodiscovery` manifest are copied onto every pipeline it generates, see
+link:/docs/core/label/#_labels_and_autodiscovery[Labels and autodiscovery].
+
+Many published policies take their pipeline labels from a `pipeline.labels` value:
+
+.updatecli-compose.yaml
+[source,yaml]
+----
+{{< include "assets/code_example/docs/udash/dashboards/updatecli-compose.yaml" >}}
+----
+
+.values.yaml
+[source,yaml]
+----
+{{< include "assets/code_example/docs/udash/dashboards/values.yaml" >}}
+----
+
+[IMPORTANT]
+====
+The top-level `labels` value of a policy sets the pull request labels, which Udash never sees.
+Only `pipeline.labels` reaches the report. Check the policy's own `values.yaml` to see which values
+it reads.
+====
+
+=== Renaming a label
+
+Reports keep the labels they were published with. After renaming `team: infra` to
+`team: platform`, the new value only matches reports published since the change.
+
+== Sharing a view
+
+The whole filter, labels included, is stored in the URL. Once a view shows what you want, copy the
+address and share it. A list of such links, one per team or ecosystem, is the closest Udash has to
+saved dashboards.
+
+== Go further
+
+* link:/docs/core/label/[Labels] - the `labels` field and the suggested vocabulary.
+* link:/docs/udash/sending-reports/[Sending reports] - the `scm` and labels these views depend on.
+* link:https://github.com/updatecli/udash[updatecli/udash] - the API, for querying reports programmatically.
diff --git a/content/en/docs/udash/introduction.adoc b/content/en/docs/udash/introduction.adoc
new file mode 100644
index 000000000..63e12e533
--- /dev/null
+++ b/content/en/docs/udash/introduction.adoc
@@ -0,0 +1,73 @@
+---
+title: "Introduction"
+description: "What Udash is, what it shows you, and how Updatecli publishes its pipeline reports to it."
+lead: "The Updatecli dashboard"
+date: 2026-08-07T10:00:00+02:00
+lastmod: 2026-09-24T10:00:00+02:00
+draft: false
+images: []
+menu:
+  docs:
+    parent: "udash"
+    identifier: "udash-introduction"
+weight: 10
+toc: true
+---
+// <!-- Required for asciidoctor -->
+:toc:
+// Set toclevels to be at least your hugo [markup.tableOfContents.endLevel] config key
+:toclevels: 4
+
+== Description
+
+An Updatecli run prints its result to the console, and the result is lost unless the CI logs are
+kept. Udash stores it. At the end of a run, Updatecli publishes each pipeline's report to Udash, and
+the interface lets you look at every repository at once, filter by label or by result, and follow
+how a dependency moved over the past weeks.
+
+[WARNING]
+====
+Udash is experimental, on both sides. Publishing reports from Updatecli requires the
+`--experimental` flag, and the API and the interface can change without going through the
+deprecation cycle described on the link:/docs/help/deprecations/["Deprecations" page].
+====
+
+== How it works
+
+Udash is a web interface backed by an API and a PostgreSQL database. Updatecli sends its reports to
+the API over HTTP, from your laptop, from CI, or from a scheduled job. Nothing in your manifests has
+to change.
+
+Two things in a manifest decide how easily you find a report again:
+
+* an `scm`, because the interface is organised per Git repository
+* link:/docs/core/label/[labels], because the filters are built on them
+
+== See it running
+
+The Updatecli project publishes the reports of its own pipelines to a public instance,
+link:https://updatecli.uda.sh[updatecli.uda.sh]. Anyone can browse it without signing in, which
+makes it a quick way to see what Udash shows before running your own. Publishing to it is reserved
+for the Updatecli project.
+
+== Getting an instance
+
+To try Udash on your own pipelines, the link:/docs/udash/quick-start/[quick start] runs it locally with Docker Compose.
+
+For a shared instance, Udash is published as a Helm chart:
+
+[source,shell]
+----
+helm repo add updatecli https://updatecli.github.io/charts
+helm install udash updatecli/udash
+----
+
+Deployment options, authentication, configuration, the in-cluster agent, and the API reference are
+documented in the link:https://github.com/updatecli/udash[updatecli/udash] repository.
+
+== Go further
+
+* link:/docs/udash/quick-start/[Quick start] - run it locally in a few minutes.
+* link:/docs/udash/sending-reports/[Sending reports] - connect Updatecli to an instance.
+* link:/docs/udash/dashboards/[Dashboards] - what the interface offers once reports arrive.
+* link:https://github.com/updatecli/udash[updatecli/udash] - the source, the operator documentation, and the issue tracker.
diff --git a/content/en/docs/udash/quick-start.adoc b/content/en/docs/udash/quick-start.adoc
new file mode 100644
index 000000000..8f52772d1
--- /dev/null
+++ b/content/en/docs/udash/quick-start.adoc
@@ -0,0 +1,140 @@
+---
+title: "Quick start"
+description: "Run Udash locally with Docker Compose, point Updatecli at it, and publish your first pipeline report."
+lead: "Udash on your laptop in five minutes"
+date: 2026-08-07T10:00:00+02:00
+lastmod: 2026-09-24T10:00:00+02:00
+draft: false
+images: []
+menu:
+  docs:
+    parent: "udash"
+weight: 20
+toc: true
+---
+// <!-- Required for asciidoctor -->
+:toc:
+// Set toclevels to be at least your hugo [markup.tableOfContents.endLevel] config key
+:toclevels: 4
+
+== Description
+
+This page runs Udash locally, then publishes a report to it from your own Updatecli runs. Nothing is
+authenticated, so do not expose this setup to anyone else.
+
+=== Requirement
+
+. Docker and Docker Compose
+. Updatecli, see link:/docs/prologue/installation/[Installation]
+
+== 1. Create the files
+
+Three files in one directory:
+
+[source,text]
+----
+.
+├── docker-compose.yaml
+├── udash
+│   └── config.yaml
+└── udash-front
+    └── config.json
+----
+
+.docker-compose.yaml
+[source,yaml]
+----
+{{< include "assets/code_example/docs/udash/quick-start/docker-compose.yaml" >}}
+----
+
+.udash/config.yaml
+[source,yaml]
+----
+{{< include "assets/code_example/docs/udash/quick-start/config.yaml" >}}
+----
+
+.udash-front/config.json
+[source,json]
+----
+{{< include "assets/code_example/docs/udash/quick-start/config.json" >}}
+----
+
+== 2. Start Udash
+
+[source,shell]
+----
+docker compose up -d
+----
+
+Open `http://localhost`. If the page does not load, `http://localhost/api/ping` tells you whether
+the API is up.
+
+[NOTE]
+====
+The server may restart a few times on the first start, while PostgreSQL gets ready. It recovers
+on its own within a few seconds.
+====
+
+== 3. Point Updatecli at it
+
+[source,shell]
+----
+updatecli udash login "http://localhost" --experimental
+----
+
+The instance has no authentication, so the command does not ask for a token. It only records the
+endpoint.
+
+== 4. Publish a report
+
+Run Updatecli as usual, with `--experimental` added:
+
+[source,shell]
+----
+updatecli diff --experimental
+----
+
+The run ends with one link per pipeline:
+
+[source,text]
+----
+UDASH - EXPERIMENTAL
+=====================
+
+Publishing report to Udash
+my pipeline:
+	=> "http://localhost/pipeline/reports/8f2b1c94-...."
+----
+
+[WARNING]
+====
+Without `--experimental`, nothing is published and nothing warns you. See the
+link:/docs/help/experimental/["Experimental features" page].
+====
+
+Refresh `http://localhost` and the report is there.
+
+If you have no manifest at hand, a published policy works too. Put this `updatecli-compose.yaml`
+in a repository you care about:
+
+.updatecli-compose.yaml
+[source,yaml]
+----
+{{< include "assets/code_example/docs/udash/quick-start/updatecli-compose.yaml" >}}
+----
+
+and run `updatecli compose diff --experimental`. Pulling a policy may require
+`docker login ghcr.io` first.
+
+== Cleaning up
+
+[source,shell]
+----
+docker compose down --volumes
+----
+
+== Go further
+
+* link:/docs/udash/sending-reports/[Sending reports] - connect Updatecli to a shared instance and to CI.
+* link:/docs/udash/dashboards/[Dashboards] - what to do with the reports once they are in.
+* link:https://github.com/updatecli/udash[updatecli/udash] - deploying a shared instance.
diff --git a/content/en/docs/udash/sending-reports.adoc b/content/en/docs/udash/sending-reports.adoc
new file mode 100644
index 000000000..c1135769e
--- /dev/null
+++ b/content/en/docs/udash/sending-reports.adoc
@@ -0,0 +1,150 @@
+---
+title: "Sending reports"
+description: "Connect Updatecli to a Udash instance, from your laptop or from CI, and make your reports easy to find."
+lead: "Publishing pipeline reports from Updatecli"
+date: 2026-08-07T10:00:00+02:00
+lastmod: 2026-09-24T10:00:00+02:00
+draft: false
+images: []
+menu:
+  docs:
+    parent: "udash"
+weight: 30
+toc: true
+---
+// <!-- Required for asciidoctor -->
+:toc:
+// Set toclevels to be at least your hugo [markup.tableOfContents.endLevel] config key
+:toclevels: 4
+
+== Description
+
+Your manifests stay the same. At the end of a run, Updatecli sends each pipeline's report to Udash.
+It needs three things from you: where to publish, a token if the instance requires one, and the
+`--experimental` flag.
+
+[WARNING]
+====
+Without `--experimental`, nothing is published. Updatecli prints no warning and the run reports
+success, even when an endpoint and a token are configured.
+====
+
+== From your laptop
+
+[source,shell]
+----
+updatecli udash login "https://udash.example.com" --experimental
+----
+
+If the instance requires authentication, the command opens its token page in a browser and asks
+you to paste an API token. Create one there, under *Profile* then *Tokens*. The command checks the
+token before saving it, so a wrong token fails immediately.
+
+If the API is not at the given URL followed by `/api`, set it with `--api-url`:
+
+[source,shell]
+----
+updatecli udash login --api-url "https://api.example.com/api" "https://udash.example.com" --experimental
+----
+
+`updatecli udash config` prints where the settings were saved, and `updatecli udash logout` removes
+them. The link:/docs/commands/updatecli_udash_login/[`updatecli udash login`] reference lists every
+flag.
+
+Then run Updatecli with `--experimental`:
+
+[source,shell]
+----
+updatecli diff --experimental
+----
+
+Each pipeline ends with a link to its stored report:
+
+[source,text]
+----
+UDASH - EXPERIMENTAL
+=====================
+
+Publishing report to Udash
+my pipeline:
+	=> "https://udash.example.com/pipeline/reports/8f2b1c94-...."
+----
+
+== From CI
+
+Use environment variables instead of `udash login`:
+
+[cols="1,3", options="header"]
+|===
+| Variable | Purpose
+
+| `UPDATECLI_UDASH_URL`
+| The Udash URL, used to build the report links.
+
+| `UPDATECLI_UDASH_API_URL`
+| The API URL. Nothing is published when it is unset.
+
+| `UPDATECLI_UDASH_ACCESS_TOKEN`
+| The Udash API token, when the instance requires one.
+|===
+
+A variable wins over the value saved by `udash login`.
+
+[source,yaml]
+----
+- name: Run Updatecli
+  env:
+    UPDATECLI_UDASH_URL: https://udash.example.com
+    UPDATECLI_UDASH_API_URL: https://udash.example.com/api
+    UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UDASH_TOKEN }}
+  run: updatecli apply --experimental
+----
+
+The token needs the `reports:write` scope, which new tokens get by default. See
+link:/docs/automate/github_action/[GitHub Actions] and link:/docs/automate/jenkins/[Jenkins] for
+the surrounding job.
+
+== Making reports easy to find
+
+The interface is organised per Git repository and filtered by label. A report with neither is
+stored, but you can only reach it through the full report list.
+
+.updatecli.yaml
+[source,yaml]
+----
+{{< include "assets/code_example/docs/udash/sending-reports/updatecli.yaml" >}}
+----
+
+* An `scm` referenced through `scmid` files the pipeline under its Git repository and puts it on
+  the Git dashboard.
+* link:/docs/core/label/[Labels] feed the filters. See
+  link:/docs/udash/dashboards/#_choosing_labels[Choosing labels].
+
+Udash rejects a label with an empty value. Leave the label out instead of setting it to `""`.
+
+== When nothing arrives
+
+[cols="1,2", options="header"]
+|===
+| Symptom | Fix
+
+| No `UDASH - EXPERIMENTAL` section, no warning
+| Add `--experimental`.
+
+| `no Udash endpoint detected, skipping`
+| Run `updatecli udash login`, or set `UPDATECLI_UDASH_API_URL`. Add `--debug` to see which
+source Updatecli read.
+
+| `403` with `token is not allowed to perform this action`
+| Your token cannot write reports. Create a token with the `reports:write` scope, or ask the
+instance administrator for the `publisher` role.
+|===
+
+Problems on the server side, such as sign-in or tokens that are always rejected, are covered in the
+link:https://github.com/updatecli/udash[updatecli/udash] repository.
+
+== Go further
+
+* link:/docs/udash/dashboards/[Dashboards] - the filters these labels feed.
+* link:/docs/help/environment/["Environment variables"] - every variable Updatecli reads.
+* link:/docs/help/experimental/["Experimental features"] - what else `--experimental` turns on.
diff --git a/updatecli/updatecli.d/udash.yaml b/updatecli/updatecli.d/udash.yaml
new file mode 100644
index 000000000..68399322e
--- /dev/null
+++ b/updatecli/updatecli.d/udash.yaml
@@ -0,0 +1,52 @@
+name: "docs: update the Udash versions used by the documentation examples"
+pipelineid: "updatecli_udash_docs"
+
+# The Udash quick start pins the server and frontend images in its Docker Compose example.
+# Tags are read from the container registry rather than GitHub releases, so a version is
+# only proposed once its image can actually be pulled.
+
+labels:
+  monitor: active
+  ecosystem: docker
+  kind: documentation
+
+actions:
+  default:
+    title: "docs: update the Udash versions used by the documentation examples"
+    kind: github/pullrequest
+    spec:
+      merge:
+        strategy: auto
+      mergemethod: squash
+      reviewers:
+        - updatecli/core
+      labels:
+        - chore
+        - documentation
+    scmid: default
+
+scms:
+  default:
+    kind: github
+    spec:
+      branch: "{{ .scm.branch }}"
+      email: "{{ .scm.email }}"
+      owner: "{{ .scm.owner }}"
+      repository: "{{ .scm.repository }}"
+      user: "{{ .scm.user }}"
+      force: true
+    disabled: false
+
+autodiscovery:
+  groupby: all
+  scmid: default
+  actionid: default
+  crawlers:
+    dockercompose:
+      rootdir: assets/code_example
+      only:
+        - images:
+            - ghcr.io/updatecli/udash
+            - ghcr.io/updatecli/udash-front
+            - updatecli/udash
+            - updatecli/udash-front