diff --git a/internal/assets/assets.go b/internal/assets/assets.go
index 5da8603..8748ac8 100644
--- a/internal/assets/assets.go
+++ b/internal/assets/assets.go
@@ -42,7 +42,8 @@ import (
 // of touching every managed file to record a number nobody read.
 //
 // 2: the knowledge-base skills and their commands.
-const Version = "2"
+// 3: CLAUDE.md documents the npx fallback for running scc uninstalled.
+const Version = "3"
 
 // The embedded tree. "all:" so nothing is silently dropped for having a name the
 // default embed pattern skips.
diff --git a/internal/assets/templates/CLAUDE.md b/internal/assets/templates/CLAUDE.md
index 686126a..55bbfe1 100644
--- a/internal/assets/templates/CLAUDE.md
+++ b/internal/assets/templates/CLAUDE.md
@@ -39,6 +39,14 @@ docs/              the knowledge base — wiki, adr, codewiki, glossary, stack
 scc validate        # every applicable validator; exit 2 means findings
 ```
 
+If `scc` is not installed on this machine, run it with no install — same binary,
+same exit codes:
+
+```
+npx @protonspy/scc validate       # always the latest
+npx @protonspy/scc@<version> ...  # pin a version (CI)
+```
+
 Exit codes are the contract: `0` ok, `1` the command could not run, `2` it ran and
 found something. A finding is an answer, not a crash.