diff --git a/README.md b/README.md
index 6ce9a75..ba4617a 100644
--- a/README.md
+++ b/README.md
@@ -10,9 +10,9 @@
 Formerly floomhq/moto and earlier buildingopen/moto. Old GitHub URLs redirect.
 
 <p align="center">
-  <img src="assets/hook-demo.gif" alt="fstack hook demo" width="800">
+  <img src="assets/hero.gif" alt="fstack hook demo" width="800">
   <br>
-  <em>A safety hook firing on a destructive command. Hero GIF coming soon.</em>
+  <em>A safety hook firing on a destructive command.</em>
 </p>
 
 ---
diff --git a/assets/hero.gif b/assets/hero.gif
new file mode 100644
index 0000000..c3a432f
Binary files /dev/null and b/assets/hero.gif differ
diff --git a/docs/demos/hero-hook-demo.sh b/docs/demos/hero-hook-demo.sh
new file mode 100755
index 0000000..fcf8a2b
--- /dev/null
+++ b/docs/demos/hero-hook-demo.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+type_slowly() {
+  local text="$1"
+  local i
+
+  for ((i = 0; i < ${#text}; i++)); do
+    printf '%s' "${text:i:1}"
+    sleep 0.045
+  done
+}
+
+printf '%s' '~/projects/api $ '
+
+sleep 1
+type_slowly 'rm -rf ~/important-data'
+
+sleep 0.5
+printf '\n'
+
+sleep 0.3
+printf '\033[31m[fstack hook] BLOCKED: destructive command outside allowlist\033[0m\n'
+
+sleep 0.3
+printf '\033[33m   reason: rm -rf without explicit --i-know-what-im-doing flag\033[0m\n'
+
+sleep 0.3
+printf "\033[32m   tip: type 'override' to bypass for this session\033[0m\n"
+
+sleep 0.3
+printf '%s' '~/projects/api $ '
+
+sleep 1.5