diff --git a/.claude/skills/docs/watermark b/.claude/skills/docs/watermark
index 3d0a9c1ae..4c74b94ce 100644
--- a/.claude/skills/docs/watermark
+++ b/.claude/skills/docs/watermark
@@ -1 +1 @@
-15a56263f52992592d97b904914626a366eee0d8
+91c98128efdbbaf9af3d71ff690cfa28eb6abded
diff --git a/docs/execution/run-configuration.mdx b/docs/execution/run-configuration.mdx
index 9674626cb..59c3954b8 100644
--- a/docs/execution/run-configuration.mdx
+++ b/docs/execution/run-configuration.mdx
@@ -155,7 +155,7 @@ preserve = true
 
 | Field | Description |
 |---|---|
-| `provider` | Sandbox mode: `local` (default), `docker`, `daytona`, or `exe`. |
+| `provider` | Sandbox mode: `local` (default), `docker`, `daytona`, `ssh`, or `exe`. |
 | `preserve` | When `true`, keep the sandbox alive after the run finishes. Useful for debugging. |
 | `devcontainer` | When `true`, use the repo's `devcontainer.json` to configure the sandbox. See [Devcontainers](/execution/devcontainers). |
 
@@ -205,6 +205,28 @@ worktree_mode = "always"
 |---|---|
 | `worktree_mode` | When to create a git worktree for the run: `always`, `clean` (default — only when the working tree is clean), `dirty` (also when dirty), or `never`. |
 
+#### `[sandbox.ssh]`
+
+Additional settings when using the SSH sandbox:
+
+```toml title="run.toml"
+[sandbox]
+provider = "ssh"
+
+[sandbox.ssh]
+destination = "user@myserver"
+working_directory = "/home/user/workspace"
+```
+
+| Field | Required | Description |
+|---|---|---|
+| `destination` | Yes | SSH destination — `user@host`, a hostname, or an SSH alias from `~/.ssh/config`. |
+| `working_directory` | Yes | Absolute path to the working directory on the remote host. |
+| `config_file` | No | Path to a custom SSH config file (e.g. for non-default keys or jump hosts). |
+| `preview_url_base` | No | Base URL for port previews (e.g. `"http://myserver"`). When set, preview URLs are `{preview_url_base}:{port}` instead of `localhost`. |
+
+See [SSH sandbox](/execution/environments#ssh) for full details.
+
 #### `[sandbox.exe]`
 
 Additional settings when using the [exe.dev](/integrations/exe-dev) cloud sandbox:
diff --git a/docs/reference/cli.mdx b/docs/reference/cli.mdx
index 2e7337437..aa42edbdd 100644
--- a/docs/reference/cli.mdx
+++ b/docs/reference/cli.mdx
@@ -56,7 +56,7 @@ arc run --run-branch arc/run/abc123
 | `--model <MODEL>` | Override default LLM model |
 | `--provider <PROVIDER>` | Override default LLM provider |
 | `-v, --verbose` | Enable verbose output |
-| `--sandbox <SANDBOX>` | Sandbox for agent tools: `local`, `docker`, `daytona`, or `exe` |
+| `--sandbox <SANDBOX>` | Sandbox for agent tools: `local`, `docker`, `daytona`, `ssh`, or `exe` |
 | `--label <KEY=VALUE>` | Attach a label to this run (repeatable) |
 | `--goal <GOAL>` | Override the workflow goal (exposed as `$goal` in prompts) |
 | `--goal-file <FILE>` | Read the goal from a file instead of inline text |
@@ -224,7 +224,7 @@ arc serve --sandbox daytona --max-concurrent-runs 4
 | `--model <MODEL>` | Override default LLM model | — |
 | `--provider <PROVIDER>` | Override default LLM provider | — |
 | `--dry-run` | Execute with simulated LLM backend | — |
-| `--sandbox <SANDBOX>` | Sandbox for agent tools: `local`, `docker`, `daytona`, or `exe` | — |
+| `--sandbox <SANDBOX>` | Sandbox for agent tools: `local`, `docker`, `daytona`, `ssh`, or `exe` | — |
 | `--max-concurrent-runs <N>` | Maximum number of concurrent run executions | — |
 | `--config <PATH>` | Path to server config file | `~/.arc/server.toml` |
 
@@ -338,6 +338,40 @@ arc system df -v
 |---|---|
 | `-v, --verbose` | Show per-run breakdown |
 
+## `arc graph`
+
+Render a workflow DOT graph as SVG or PNG. Requires [Graphviz](https://graphviz.org) (`dot`) to be installed.
+
+```bash
+arc graph workflow.dot
+arc graph workflow.dot --format png -o diagram.png
+arc graph run.toml --format svg
+```
+
+| Argument / Flag | Description |
+|---|---|
+| `<WORKFLOW>` | Path to a `.dot` workflow file or `.toml` run config (required) |
+| `--format <FORMAT>` | Output format: `svg` (default) or `png` |
+| `-o, --output <FILE>` | Output file path. Defaults to stdout. |
+
+## `arc skill install`
+
+Install the built-in `arc-create-workflow` skill for AI assistants (Claude Code, Codex). The skill teaches AI assistants Arc's DOT syntax, node types, and run configuration format.
+
+```bash
+# Install into the current project (.claude/skills/ or .agents/skills/)
+arc skill install --for project --dir claude
+
+# Install for all projects (user-level, ~/.claude/skills/)
+arc skill install --for user --dir claude
+```
+
+| Flag | Description |
+|---|---|
+| `--for <SCOPE>` | `user` (default) — installs to `~/<dir>/skills/`. `project` — installs to `./<dir>/skills/`. |
+| `--dir <DIR>` | Directory convention: `claude` (`.claude/skills/`) or `agents` (`.agents/skills/`). Required. |
+| `--force` | Overwrite an existing installation without prompting. |
+
 ## `arc validate`
 
 Validate a workflow file without executing it. Reports errors and warnings. Accepts both `.dot` workflow files and `.toml` run configs.