diff --git a/Makefile b/Makefile
index 3511905..24bff87 100644
--- a/Makefile
+++ b/Makefile
@@ -5,6 +5,7 @@ test:
 	./tests/host/network_monitor_test.sh
 	python3 -m unittest tests/test_network_portal.py
 	python3 -m unittest tests/test_imager_app.py
+	python3 -m unittest tests/test_manifest_metadata.py
 	python3 -m py_compile host/imager_app.py device/network/network_portal.py
 	@for file in $$(find host device site -type f \( -name '*.sh' -o -name cdmx-network \)); do bash -n "$$file"; done
 
diff --git a/README.en.md b/README.en.md
index 8814bbe..93dc4af 100644
--- a/README.en.md
+++ b/README.en.md
@@ -140,9 +140,11 @@ image/cdmx-workshop-golden.img.xz
 image/cdmx-workshop-golden.img.xz.sha512
 ```
 
-Before publishing, update `version`, sizes, SHA-512, and `docker` in
-`site/manifest.json`. The public site and both helpers consume that same file,
-so every operator flashes exactly the same version.
+Before publishing, update `version`, sizes, SHA-512, `docker`, and the immutable
+`simulator` commits in `site/manifest.json`. The public site, both helpers, and
+the [workshop simulator](https://radxa-simulator.mantilla.ca) consume that same
+file, so they all use exactly the same version. Lepton checks the manifest every
+five minutes and refreshes the simulator when that fingerprint changes.
 
 ## Docker and publication
 
diff --git a/README.md b/README.md
index 5e1a3f5..7dcc62b 100644
--- a/README.md
+++ b/README.md
@@ -142,9 +142,12 @@ image/cdmx-workshop-golden.img.xz
 image/cdmx-workshop-golden.img.xz.sha512
 ```
 
-Antes de publicar, actualice `version`, tamaños, SHA‑512 y `docker` en
-`site/manifest.json`. El mismo archivo alimenta la web pública y ambos
-ayudantes, de modo que todos graban exactamente la misma versión.
+Antes de publicar, actualice `version`, tamaños, SHA‑512, `docker` y los commits
+inmutables de `simulator` en `site/manifest.json`. El mismo archivo alimenta la
+web pública, ambos ayudantes y
+[el simulador del taller](https://radxa-simulator.mantilla.ca), de modo que
+todos usan exactamente la misma versión. Lepton consulta el manifiesto cada
+cinco minutos y actualiza el simulador cuando cambia ese fingerprint.
 
 ## Docker y publicación
 
diff --git a/site/manifest.json b/site/manifest.json
index dcc1bc5..f8b79b3 100644
--- a/site/manifest.json
+++ b/site/manifest.json
@@ -11,6 +11,12 @@
     "compressed_bytes": 1908043732,
     "uncompressed_bytes": 8074662912
   },
+  "simulator": {
+    "url": "https://radxa-simulator.mantilla.ca",
+    "source_commit": "c75070da318021b0889c00924c824dfeba4a306e",
+    "bayesopt_source": "https://github.com/the-matter-lab/cdmx-bayesopt",
+    "bayesopt_commit": "2932febb16af89a465d4e7903d4eb0268489c045"
+  },
   "launchers": {
     "macos_terminal": "https://cdmx-radxaflash.mantilla.ca/start-macos.sh",
     "windows_powershell": "https://cdmx-radxaflash.mantilla.ca/start-windows.ps1",
diff --git a/tests/test_manifest_metadata.py b/tests/test_manifest_metadata.py
new file mode 100644
index 0000000..8fd1698
--- /dev/null
+++ b/tests/test_manifest_metadata.py
@@ -0,0 +1,35 @@
+import json
+import re
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).parents[1]
+
+
+class ManifestMetadataTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.manifest = json.loads((ROOT / "site" / "manifest.json").read_text())
+
+    def test_simulator_uses_production_https_url(self):
+        self.assertEqual(
+            self.manifest["simulator"]["url"],
+            "https://radxa-simulator.mantilla.ca",
+        )
+
+    def test_simulator_sources_are_immutable_commits(self):
+        simulator = self.manifest["simulator"]
+        self.assertRegex(simulator["source_commit"], r"^[0-9a-f]{40}$")
+        self.assertRegex(simulator["bayesopt_commit"], r"^[0-9a-f]{40}$")
+        self.assertRegex(
+            simulator["bayesopt_source"],
+            r"^https://github\.com/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+        )
+
+    def test_manifest_image_checksum_is_immutable(self):
+        self.assertTrue(re.fullmatch(r"[0-9a-f]{128}", self.manifest["image"]["sha512"]))
+
+
+if __name__ == "__main__":
+    unittest.main()