diff --git a/.gitea/pull_request_template.md b/.gitea/pull_request_template.md
index 54899d3..9d205eb 100644
--- a/.gitea/pull_request_template.md
+++ b/.gitea/pull_request_template.md
@@ -3,8 +3,13 @@
 Merging this deploys to production (pfv-bms restarts if packages/** or
 configuration.yaml changed).
 
+### Change management (ruling 2026-09-06 — mandatory)
+- GLPI CR deep link (required): https://cmdb.knownelement.com/front/change.form.php?id=N
+  - Dev-only PRs: state `no-CR (dev-only)` explicitly.
+
 ### Gate checklist (branch protection enforces the mechanical parts)
 - [ ] CI green on the head commit (yamllint + secret scan + SDLC suite)
+- [ ] CR filed in GLPI and referenced above (production changes)
 - [ ] Adversarial pass done: what breaks if this is wrong? what watches for it?
 - [ ] post-deploy validation (#778) will run on restart — expected entity changes noted below