diff --git a/profile/brand/brand.lock.json b/.github/brand/brand.lock.json
similarity index 88%
rename from profile/brand/brand.lock.json
rename to .github/brand/brand.lock.json
index 9d6700b..8a7ae68 100644
--- a/profile/brand/brand.lock.json
+++ b/.github/brand/brand.lock.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 2,
   "authority": "https://github.com/computer-mcp/.github",
-  "revision": "fe16fb823ef36fd1853ec1844b02d360ac203a1323054b79232fc7e1057c3563",
+  "revision": "9042c987ef8b3482f63e3a037ae0d0d2fdeffb9a7768c03295c9a6a6c5a43ae2",
   "consumer": ".github",
   "files": {
     "profile/brand/header-light.png": "821b9c5a2ad1a821acef6ffd9d035d3d856b17314f0bd9adb863ce77b52060f2",
diff --git a/.github/workflows/brand-check.yml b/.github/workflows/brand-check.yml
index d94b557..d3a20cd 100644
--- a/.github/workflows/brand-check.yml
+++ b/.github/workflows/brand-check.yml
@@ -1,11 +1,6 @@
 name: Brand
 on:
   workflow_call:
-    inputs:
-      lock:
-        description: Brand lock path in the calling repository
-        type: string
-        default: Documentation/Brand/brand.lock.json
 permissions:
   contents: read
 jobs:
@@ -17,17 +12,15 @@ jobs:
         with:
           persist-credentials: false
       - name: Verify locked brand delivery
-        env:
-          LOCK: ${{ inputs.lock }}
         run: |
-          python3 - "$LOCK" <<'PY'
+          python3 - <<'PY'
           import hashlib, json, sys
           from pathlib import Path
 
           root = Path.cwd().resolve()
-          lock = json.loads((root / sys.argv[1]).read_text())
+          lock = json.loads((root / ".github/brand/brand.lock.json").read_text())
           if lock.get("schema_version") != 2 or lock.get("authority") != "https://github.com/computer-mcp/.github":
-              sys.exit(f"{sys.argv[1]} is not a Computer MCP brand lock")
+              sys.exit(".github/brand/brand.lock.json is not a Computer MCP brand lock")
           errors = []
           for name, expected in lock["files"].items():
               path = (root / name).resolve()
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 13849aa..dfc920c 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -21,5 +21,3 @@ jobs:
         run: python3 Brand/brand.py check
   profile:
     uses: ./.github/workflows/brand-check.yml
-    with:
-      lock: profile/brand/brand.lock.json
diff --git a/Brand/Exports/manifest.json b/Brand/Exports/manifest.json
index eea4c96..cbff65b 100644
--- a/Brand/Exports/manifest.json
+++ b/Brand/Exports/manifest.json
@@ -2,7 +2,7 @@
   "schema_version": 1,
   "inputs": {
     "DESIGN.md": "baf0318de7b9fb5e9b24d9201e806ec9545dc526e3c79197dcfa0e83f0ddf220",
-    "Brand/config.json": "06f0dc75d3f2e890180271293751452782c1504241a5ec1ff028f22b727f0bd0",
+    "Brand/config.json": "e116853724002cc2e1dbfbe4e092cf26d4922e11b51911408307fb47379443e5",
     "Brand/icons.mjs": "1c3676dcdc5fdcaf81daa096dc61a536be2f02704748d3c02bda918fb26cb97d",
     "Brand/render.mjs": "a8927cab0db45f9326f353fba40ea3bcbb326b6a0508a53b7e3bafbbe7d14dc4",
     "Brand/package.json": "c5d5e11a37021178ac682ce2fd64a2f55dc4dfe4f333b64f0079cb1ef54686cd",
diff --git a/Brand/brand.py b/Brand/brand.py
index c38d548..72bf6d2 100644
--- a/Brand/brand.py
+++ b/Brand/brand.py
@@ -19,6 +19,7 @@
 ROOT = BRAND.parent
 EXPORTS = BRAND / "Exports"
 VERIFIER = ROOT / ".github/workflows/brand-check.yml"
+LOCK = ".github/brand/brand.lock.json"
 CONFIG = json.loads((BRAND / "config.json").read_text())
 
 
@@ -88,10 +89,10 @@ def inside(root, name):
     return path
 
 
-def verify(root, lock):
+def verify(root):
     workflow = VERIFIER.read_text()
     script = workflow.split("<<'PY'\n", 1)[1].split("\n          PY\n", 1)[0]
-    return subprocess.run([sys.executable, "-", lock], input=textwrap.dedent(script), text=True, cwd=root).returncode
+    return subprocess.run([sys.executable, "-"], input=textwrap.dedent(script), text=True, cwd=root).returncode
 
 
 def sync(checkout, repository):
@@ -100,7 +101,7 @@ def sync(checkout, repository):
     root = Path(checkout).resolve()
     repository = repository or repository_of(root)
     spec, entries = resolve(repository)
-    lock_path = inside(root, spec["lock"])
+    lock_path = inside(root, LOCK)
     previous = json.loads(lock_path.read_text())["files"] if lock_path.exists() else {}
     files = {}
     for target, source in deliveries(spec):
@@ -121,7 +122,7 @@ def sync(checkout, repository):
     lock_path.parent.mkdir(parents=True, exist_ok=True)
     lock_path.write_text(json.dumps(lock, indent=2, ensure_ascii=False) + "\n")
     print(f"Delivered {len(files)} brand files to {repository}", flush=True)
-    return verify(root, spec["lock"])
+    return verify(root)
 
 
 def main():
diff --git a/Brand/config.json b/Brand/config.json
index bbff595..31f0991 100644
--- a/Brand/config.json
+++ b/Brand/config.json
@@ -105,7 +105,6 @@
   ],
   "consumers": {
     ".github": {
-      "lock": "profile/brand/brand.lock.json",
       "files": {
         "profile/brand/header-light.png": "headers/computer-mcp-light.png",
         "profile/brand/header-dark.png": "headers/computer-mcp-dark.png",
@@ -116,15 +115,13 @@
       }
     },
     "computer-mcp": {
-      "lock": "Documentation/Brand/brand.lock.json",
       "files": {
         "Documentation/Brand/header-light.png": "headers/computer-mcp-light.png",
         "Documentation/Brand/header-dark.png": "headers/computer-mcp-dark.png",
         "Documentation/Brand/header-zh-CN-light.png": "headers/computer-mcp-zh-CN-light.png",
         "Documentation/Brand/header-zh-CN-dark.png": "headers/computer-mcp-zh-CN-dark.png",
-        "Documentation/Brand/social.png": "social/computer-mcp.png",
-        "Documentation/Brand/social-zh-CN.png": "social/computer-mcp-zh-CN.png",
-        "Documentation/Brand/icon.png": "app/app-icon.png",
+        ".github/brand/social.png": "social/computer-mcp.png",
+        ".github/brand/social-zh-CN.png": "social/computer-mcp-zh-CN.png",
         "Resources/ComputerMCPApp/AppIcon.icon/": "app/AppIcon.icon/"
       },
       "entries": {
@@ -133,7 +130,6 @@
       }
     },
     "computer-mcp.github.io": {
-      "lock": "public/brand/brand.lock.json",
       "files": {
         "public/brand/icon.svg": "app/app-icon.svg",
         "public/brand/favicon.svg": "web/favicon.svg",
@@ -154,13 +150,10 @@
       }
     },
     "@member": {
-      "lock": "Documentation/Brand/brand.lock.json",
       "files": {
         "Documentation/Brand/header-light.png": "headers/{repository}-light.png",
         "Documentation/Brand/header-dark.png": "headers/{repository}-dark.png",
-        "Documentation/Brand/social.png": "social/{repository}.png",
-        "Documentation/Brand/icon.svg": "icons/{repository}.svg",
-        "Documentation/Brand/icon.png": "icons/{repository}.png"
+        ".github/brand/social.png": "social/{repository}.png"
       },
       "entries": {
         "README.md": ["@title", "Documentation/Brand/header-light.png", "Documentation/Brand/header-dark.png"]
diff --git a/README.md b/README.md
index 4a33800..f603dbc 100644
--- a/README.md
+++ b/README.md
@@ -30,13 +30,13 @@ Text rendered into images (`Brand/config.json` `copy` and `members`) must match
 
 `python3 Brand/brand.py sync <checkout>` copies the files that repository uses,
 removes files its previous lock delivered and no longer needs, rewrites its
-`brand.lock.json`, and verifies the lock. Commit the result through a pull
-request in that repository. Each repository's CI calls the shared check:
+`.github/brand/brand.lock.json`, and verifies the lock. Images that ship with a
+repository's packaged documentation live in `Documentation/Brand/`; social
+previews stay in `.github/brand/`. Commit the result through a pull request in
+that repository. Each repository's CI calls the shared check:
 
 ```yaml
 jobs:
   brand:
     uses: computer-mcp/.github/.github/workflows/brand-check.yml@<commit>
-    with:
-      lock: Documentation/Brand/brand.lock.json
 ```