diff --git a/README.md b/README.md
index 90295153..069ee704 100644
--- a/README.md
+++ b/README.md
@@ -44,6 +44,50 @@ Agent Scan helps you keep an inventory of all your installed agent components (h
 >
 > By default, Agent Scan requires explicit user consent (y/n) before starting each stdio MCP server during interactive runs. This gives you control over what gets executed on your system.
 
+## Quick Start
+
+Choose one of two ways to run Agent Scan:
+
+1. **Run the Python package with `uvx`** using the instructions below.
+2. **Download a standalone binary** for your platform from [GitHub Releases](https://github.com/snyk/agent-scan/releases). Releases also include the SBOM, checksums, signed checksums, and source code archives.
+
+Before using either option:
+
+1. **Sign up at [Snyk](https://snyk.io)** and get an API token from [https://app.snyk.io/account](https://app.snyk.io/account) (API Token → KEY → click to show).
+2. **Set the token as an environment variable** before running any scan:
+   ```bash
+   export SNYK_TOKEN=your-api-token-here
+   ```
+
+### Run with `uvx`
+
+Have [uv](https://docs.astral.sh/uv/getting-started/installation/) installed on your system, then run a full scan of your machine (auto-discovers agents, MCP servers, and skills):
+
+```bash
+uvx snyk-agent-scan@latest
+```
+
+This will scan for security vulnerabilities in MCP servers, tools, prompts, and resources. It will automatically discover a variety of agent configurations, including Claude Code/Desktop, Cursor, Gemini CLI, and Windsurf.
+
+You can also scan particular MCP configuration files or skills:
+
+```bash
+# scan a specific mcp configuration
+uvx snyk-agent-scan@latest ~/.vscode/mcp.json
+# scan a single agent skill
+uvx snyk-agent-scan@latest ~/path/to/my/SKILL.md
+# scan all claude skills
+uvx snyk-agent-scan@latest ~/.claude/skills
+```
+
+### Run with a standalone binary
+
+Download the binary for your operating system and architecture from the [latest GitHub Release](https://github.com/snyk/agent-scan/releases/latest). The release page also provides an SBOM (`sbom-<version>.json`), checksum files, and GitHub-generated source code archives. See [Verifying Standalone Binaries](#verifying-standalone-binaries) to verify your download.
+
+### Example Run
+
+[![Agent Scan security vulnerabilities demo](demo.svg)](https://asciinema.org/a/716858)
+
 ## Highlights
 
 - Auto-discover MCP configurations, agent tools, skills
@@ -110,47 +154,6 @@ Legend: **✓** detected · **✗** the agent supports this but Agent Scan does
 
 ‡ Amp stores project/workspace skills at `.agents/skills` (and the `.claude/skills` compatibility path); only the user-scope `~/.config/agents/skills` is detected today, so project-scope skills are supported but not yet scanned.
 
-## Quick Start
-
-To get started:
-
-1. **Sign up at [Snyk](https://snyk.io)** and get an API token from [https://app.snyk.io/account](https://app.snyk.io/account) (API Token → KEY → click to show).
-2. **Set the token as an environment variable** before running any scan:
-   ```bash
-   export SNYK_TOKEN=your-api-token-here
-   ```
-3. Have [uv](https://docs.astral.sh/uv/getting-started/installation/) installed on your system.
-
-### Scanning
-
-To run a full scan of your machine (auto-discovers agents, MCP servers, skills), run:
-
-```bash
-uvx snyk-agent-scan@latest
-```
-
-
-This will scan for security vulnerabilities in MCP servers, tools, prompts, and resources. It will automatically discover a variety of agent configurations, including Claude Code/Desktop, Cursor, Gemini CLI, and Windsurf.
-
-```bash
-uvx snyk-agent-scan@latest
-```
-
-You can also scan particular MCP configuration files or skills:
-
-```bash
-# scan a specific mcp configuration
-uvx snyk-agent-scan@latest ~/.vscode/mcp.json
-# scan a single agent skill
-uvx snyk-agent-scan@latest ~/path/to/my/SKILL.md
-# scan all claude skills
-uvx snyk-agent-scan@latest ~/.claude/skills
-```
-
-#### Example Run
-
-[![Agent Scan security vulnerabilities demo](demo.svg)](https://asciinema.org/a/716858)
-
 ## Verifying Standalone Binaries
 
 We use GPG signing on the release checksums file to ensure distribution integrity and authenticity.