diff --git a/docs/assets/step1-run-whoami.gif b/docs/assets/step1-run-whoami.gif
new file mode 100644
index 0000000..64c62e9
--- /dev/null
+++ b/docs/assets/step1-run-whoami.gif
Binary files differ
diff --git a/docs/assets/step2-add-cluster.gif b/docs/assets/step2-add-cluster.gif
new file mode 100644
index 0000000..3d1e41e
--- /dev/null
+++ b/docs/assets/step2-add-cluster.gif
Binary files differ
diff --git a/docs/assets/step3-issue-cert.gif b/docs/assets/step3-issue-cert.gif
new file mode 100644
index 0000000..ca15725
--- /dev/null
+++ b/docs/assets/step3-issue-cert.gif
Binary files differ
diff --git a/docs/assets/step4-add-filter-chain.gif b/docs/assets/step4-add-filter-chain.gif
new file mode 100644
index 0000000..d5a64e5
--- /dev/null
+++ b/docs/assets/step4-add-filter-chain.gif
Binary files differ
diff --git a/docs/assets/step5-trust-ca.gif b/docs/assets/step5-trust-ca.gif
new file mode 100644
index 0000000..6b0fe1b
--- /dev/null
+++ b/docs/assets/step5-trust-ca.gif
Binary files differ
diff --git a/docs/assets/step6-etc-hosts.gif b/docs/assets/step6-etc-hosts.gif
new file mode 100644
index 0000000..8781af2
--- /dev/null
+++ b/docs/assets/step6-etc-hosts.gif
Binary files differ
diff --git a/docs/assets/step7-browser-verify.gif b/docs/assets/step7-browser-verify.gif
new file mode 100644
index 0000000..9e2d2b6
--- /dev/null
+++ b/docs/assets/step7-browser-verify.gif
Binary files differ
diff --git a/docs/tutorial-whoami-local-https.md b/docs/tutorial-whoami-local-https.md
index 513a941..8e49279 100644
--- a/docs/tutorial-whoami-local-https.md
+++ b/docs/tutorial-whoami-local-https.md
@@ -31,6 +31,8 @@
 
 It runs independently — no changes to your existing `docker-compose.yml` needed.
 
+![Run whoami container](assets/step1-run-whoami.gif)
+
 ---
 
 ## Step 2 — Add a cluster in Aegis
@@ -49,6 +51,8 @@
 
 Save — Aegis pushes the cluster to Envoy immediately.
 
+![Add whoami cluster in Aegis](assets/step2-add-cluster.gif)
+
 ---
 
 ## Step 3 — Issue a Local CA certificate
@@ -69,6 +73,8 @@
 
 Click **Issue**. The cert is generated and pushed to Envoy SDS within a second. Note the **secret name** shown (e.g. `tls-whoami-local`).
 
+![Issue certificate from Local CA](assets/step3-issue-cert.gif)
+
 ---
 
 ## Step 4 — Add a filter chain to the HTTPS listener
@@ -85,33 +91,43 @@
 
 Leave Route Prefix as `/` and click **Add**. Envoy picks up the new filter chain within ~1 second.
 
+![Add filter chain to HTTPS listener](assets/step4-add-filter-chain.gif)
+
 ---
 
 ## Step 5 — Trust the Root CA
 
-Download the Root CA certificate and install it in your OS trust store.
+First, download the Root CA certificate. You can do this two ways:
+
+**Option A — from the UI:** Go to **Certificates → Signing Providers**, click **Download CA Cert** next to your Local CA provider. This downloads `aegis-local-ca.crt` directly from the browser.
+
+**Option B — via curl:**
+```bash
+curl -s http://localhost:8765/api/certs/ca -o aegis-local-ca.crt
+```
+
+Then install it in your OS trust store:
 
 **macOS:**
 ```bash
-curl -s http://localhost:8765/api/certs/ca -o aegis-local-ca.crt
 sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain aegis-local-ca.crt
 ```
 
 **Linux:**
 ```bash
-curl -s http://localhost:8765/api/certs/ca -o aegis-local-ca.crt
 sudo cp aegis-local-ca.crt /usr/local/share/ca-certificates/aegis-local-ca.crt
 sudo update-ca-certificates
 ```
 
 **Windows (PowerShell as Administrator):**
 ```powershell
-Invoke-WebRequest http://localhost:8765/api/certs/ca -OutFile aegis-local-ca.crt
 Import-Certificate -FilePath aegis-local-ca.crt -CertStoreLocation Cert:\LocalMachine\Root
 ```
 
 Restart your browser after installing the CA.
 
+![Download and trust the Root CA](assets/step5-trust-ca.gif)
+
 ---
 
 ## Step 6 — Add an `/etc/hosts` entry
@@ -131,6 +147,8 @@
 
 On Windows, edit `C:\Windows\System32\drivers\etc\hosts` as Administrator.
 
+![Add whoami.local to /etc/hosts](assets/step6-etc-hosts.gif)
+
 ---
 
 ## Step 7 — Open in browser
@@ -139,6 +157,8 @@
 
 You should see the whoami response — hostname, IP, headers — served over HTTPS with a valid (locally trusted) certificate and no browser warning.
 
+![whoami.local trusted in browser](assets/step7-browser-verify.gif)
+
 ---
 
 ## What just happened