diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index 750324c..baa82af 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -95,6 +95,82 @@ meshguard up [options]
 
 ---
 
+## `meshguard connect`
+
+Direct peer connection via token exchange (no seed node needed). Performs a coordinated UDP hole punch.
+
+```bash
+meshguard connect --generate [--in <minutes>]
+meshguard connect --join <mg://token>
+```
+
+| Flag | Description |
+| ---- | ----------- |
+| `--generate` | Run as initiator. Generates a token to share with the peer. |
+| `--in <minutes>` | Wait time before coordinated punch (default: 1). |
+| `--join` | Run as joiner. Accepts an `mg://` token. |
+
+---
+
+## `meshguard org-keygen`
+
+Generate a new Ed25519 organization keypair.
+
+```bash
+meshguard org-keygen
+```
+
+**Output files** (in `$MESHGUARD_CONFIG_DIR`, default `~/.config/meshguard/org/`):
+
+- `org.key` — secret key
+- `org.pub` — public key
+
+Generates an org keypair and derives the deterministic mesh domain (e.g., `a1b2c3.mesh`).
+
+---
+
+## `meshguard org-sign`
+
+Sign a node's public key with the org private key, producing a `NodeCertificate`.
+
+```bash
+meshguard org-sign <node.pub> --name <label> [--expires <unix-timestamp>]
+```
+
+| Argument | Description |
+| -------- | ----------- |
+| `<node.pub>` | Path to the node's `.pub` file or base64 key |
+| `--name` | Required human-readable label for the node |
+| `--expires` | Optional unix timestamp for certificate expiration |
+
+---
+
+## `meshguard org-vouch`
+
+Vouch for an external node without making it a full org member. The vouch propagates to all org members via gossip.
+
+```bash
+meshguard org-vouch <node.pub>
+```
+
+| Argument | Description |
+| -------- | ----------- |
+| `<node.pub>` | Path to the external node's `.pub` file or base64 key |
+
+---
+
+## `meshguard upgrade`
+
+Upgrade meshguard to the latest release from GitHub.
+
+```bash
+meshguard upgrade
+```
+
+Queries the GitHub API, downloads the latest `meshguard-linux-amd64` binary, replaces the current executable, and restarts the systemd service if running.
+
+---
+
 ## `meshguard down`
 
 Stop the daemon and remove the `mg0` interface.
diff --git a/src/services/control.zig b/src/services/control.zig
index 6dd5d47..0eb904f 100644
--- a/src/services/control.zig
+++ b/src/services/control.zig
@@ -85,7 +85,7 @@ pub const ControlSocket = struct {
         try std.posix.listen(sock, 4);
 
         // Make socket accessible to non-root users
-        std.fs.cwd().chmod(self.socket_path, 0o666) catch {};
+        std.posix.fchmodat(std.fs.cwd().fd, self.socket_path, 0o666, 0) catch {};
 
         self.server = sock;
     }
diff --git a/test_chmod.zig b/test_chmod.zig
new file mode 100644
index 0000000..d0abbc2
--- /dev/null
+++ b/test_chmod.zig
@@ -0,0 +1,5 @@
+const std = @import("std");
+pub fn main() !void {
+    std.posix.fchmodat(std.fs.cwd().fd, "test_file.txt", 0o666, 0) catch {};
+    std.debug.print("chmod ok\n", .{});
+}