diff --git a/public/banners/hardening-a-tor-onion-service.png b/public/banners/hardening-a-tor-onion-service.png
index 8f3175c..fb35f00 100644
Binary files a/public/banners/hardening-a-tor-onion-service.png and b/public/banners/hardening-a-tor-onion-service.png differ
diff --git a/public/og/hardening-a-tor-onion-service.png b/public/og/hardening-a-tor-onion-service.png
index 972e839..a93556a 100644
Binary files a/public/og/hardening-a-tor-onion-service.png and b/public/og/hardening-a-tor-onion-service.png differ
diff --git a/scripts/banner-gen/generate.mjs b/scripts/banner-gen/generate.mjs
index 413f1f4..ea18372 100644
--- a/scripts/banner-gen/generate.mjs
+++ b/scripts/banner-gen/generate.mjs
@@ -114,6 +114,25 @@ const BANNERS = {
     ],
   },
 
+  'hardening-a-tor-onion-service': {
+    titlebar: 'root@tor-host — onion service audit',
+    lines: [
+      { t: 'prompt', text: '$' }, { t: 'cmd', text: 'wget -qO- ipv4.icanhazip.com   # from inside the app' },
+      { t: 'err', text: '→ home IP returned · iptables block silently gone' },
+      { t: 'prompt', text: '$' }, { t: 'cmd', text: 'cap_add: NET_BIND_SERVICE · keep :80' },
+      { t: 'err', text: 'listen tcp :80: bind: permission denied · CapEff=0' },
+      { t: 'prompt', text: '$' }, { t: 'cmd', text: 'networks: internal:true · port 8080 · SocksPort 0' },
+      { t: 'ok', text: '→ bad address ✓ · zero egress ✓ · all containers healthy ✓' },
+    ],
+    flow: [
+      { n: '1', label: 'Audit egress', err: true },
+      { n: '2', label: 'internal:true' },
+      { n: '3', label: 'non-root :8080' },
+      { n: '4', label: 'healthchecks' },
+      { n: '5', label: 'verify ✓' },
+    ],
+  },
+
   'hello-world': {
     titlebar: '~/hoelee-blog — first commit',
     lines: [
diff --git a/scripts/og-gen/generate.mjs b/scripts/og-gen/generate.mjs
index 99fc9f6..e8ca240 100644
--- a/scripts/og-gen/generate.mjs
+++ b/scripts/og-gen/generate.mjs
@@ -83,6 +83,11 @@ const TERMINALS = {
     <div class="line"><span class="prompt">$</span><span class="cmd">POST /api/verifyConnection</span></div>
     <div class="line"><span class="prompt">&nbsp;</span><span class="err">404 · API prefix dropped in v2</span></div>
     <div class="line"><span class="prompt">$</span><span class="cmd">csrftoken → /verifyLogin → fetchWebsitesList</span><span class="fix">→ sites ✓</span></div>`,
+
+  'hardening-a-tor-onion-service': `
+    <div class="line"><span class="prompt">$</span><span class="cmd">wget -qO- ipv4.icanhazip.com</span></div>
+    <div class="line"><span class="prompt">&nbsp;</span><span class="err">bind: permission denied · CapEff=0 on :80</span></div>
+    <div class="line"><span class="prompt">$</span><span class="cmd">internal:true · :8080 · SocksPort 0</span><span class="fix">→ zero egress ✓</span></div>`,
   };
 
 const DEFAULT_TERMINAL = `