diff --git a/README.md b/README.md
index 371955f..12fc4fa 100644
--- a/README.md
+++ b/README.md
@@ -60,8 +60,9 @@ bash scripts/post-install.sh
 The installer will:
 1. Copy the plugin to `~/.openclaw/extensions/memory-continuity/`
 2. Add the plugin entry to `~/.openclaw/openclaw.json`
-3. Add `memory-continuity` to `plugins.allow` (trust list — eliminates provenance warnings)
-4. Restart the gateway
+3. Add `memory-continuity` to `plugins.allow` (trust list)
+4. Add install record to `plugins.installs` (provenance tracking)
+5. Restart the gateway
 
 No npm install, no API keys, no external database.
 
diff --git a/scripts/post-install.sh b/scripts/post-install.sh
index e826878..4526d58 100755
--- a/scripts/post-install.sh
+++ b/scripts/post-install.sh
@@ -51,20 +51,7 @@ if [[ ! -f "$CONFIG_FILE" ]]; then
   echo "  You'll need to manually add the plugin entry."
 else
   # Check if memory-continuity entry already exists
-  if python3 -c "
-import json, sys
-with open('$CONFIG_FILE') as f:
-    data = json.load(f)
-entries = data.get('plugins', {}).get('entries', {})
-if 'memory-continuity' in entries:
-    print('exists')
-    sys.exit(0)
-else:
-    sys.exit(1)
-" 2>/dev/null; then
-    echo "  Plugin entry already exists in config"
-  else
-    # Add the plugin entry and plugins.allow trust list
+  # Always ensure allow list, install record, and entry are present (idempotent)
     python3 -c "
 import json
 path = '$CONFIG_FILE'
@@ -90,11 +77,18 @@ data['plugins']['entries']['memory-continuity'] = {
         'autoExtract': True
     }
 }
+# Add install record for provenance tracking (eliminates untracked-code warning)
+if 'installs' not in data['plugins']:
+    data['plugins']['installs'] = {}
+data['plugins']['installs']['memory-continuity'] = {
+    'source': 'path',
+    'installPath': '~/.openclaw/extensions/memory-continuity',
+    'sourcePath': '$REPO_DIR'
+}
 with open(path, 'w') as f:
     json.dump(data, f, indent=2)
-print('  Added plugin entry and trust config')
+print('  Added plugin entry, trust config, and install record')
 " 2>/dev/null || echo "  WARNING: Could not update config automatically. Add manually."
-  fi
 fi
 
 # Step 3: Restart gateway