diff --git a/content/cryptominer-in-the-docker-layer.md b/content/cryptominer-in-the-docker-layer.md
index d5fa799c..83d85cf3 100644
--- a/content/cryptominer-in-the-docker-layer.md
+++ b/content/cryptominer-in-the-docker-layer.md
@@ -4,6 +4,7 @@ Modified: 2026-09-11 09:00
 Author: Oliver Rivas
 Category: DevSecOps
 Tags: incident-response, devsecops, docker, forensics
+Series: Anatomy of a Container Incident
 Slug: cryptominer-in-the-docker-layer
 Og_image: images/og/cryptominer-in-the-docker-layer.png
 Summary: A runtime detector flagged mining but ps and ss came back clean. The miner lived in the image's overlay2 diff layer, relaunched on every container restart.
diff --git a/content/hiring-discovery-layer-broken.md b/content/hiring-discovery-layer-broken.md
index decbe9e8..153c854b 100644
--- a/content/hiring-discovery-layer-broken.md
+++ b/content/hiring-discovery-layer-broken.md
@@ -4,6 +4,7 @@ Modified: 2026-07-11
 Author: Oliver Rivas
 Category: DevSecOps
 Tags: careers, devsecops, hiring
+Series: Hiring as an Adversarial System
 Slug: hiring-discovery-layer-broken
 Og_image: images/og/hiring-discovery-layer-broken.png
 Summary: The senior engineering market has a routing failure, not a talent shortage: resumes and funnels index for keywords and discard the signal seniors depend on.
@@ -59,7 +60,7 @@ Some shortages are real. Security, infrastructure, identity, Kubernetes, cloud a
 
 The deeper problem is that current hiring systems are also bad at recognizing them when they appear.
 
-The cost is not just candidate frustration. It is organizational velocity. Teams spend months searching for the perfect resume while security debt, platform fragility, and operational risk keep accumulating.
+Candidate frustration is only the visible cost. The buried one is organizational velocity: teams spend months searching for the perfect resume while security debt, platform fragility, and operational risk keep accumulating.
 
 A staff or principal engineer may have the exact experience a team needs, but describe it in production language instead of job-post language. They may write about reducing IAM blast radius instead of listing every AWS service in the account. They may talk about evidence quality, auditability, and rollback paths instead of using the phrase "DevSecOps transformation." They may have done the work without wrapping it in the vocabulary the filter expects.
 
diff --git a/content/static/custom.css b/content/static/custom.css
index 37aae9ab..f94cd148 100644
--- a/content/static/custom.css
+++ b/content/static/custom.css
@@ -912,3 +912,20 @@ main footer a {
 .author-bio p { margin: 0; color: var(--fg); line-height: 1.5; }
 .author-bio a { color: var(--accent); }
 @media (max-width: 600px) { .author-bio { flex-direction: column; text-align: center; } }
+
+/* Series navigation box (partial/series_nav.html): ordered part list shown
+   when a post belongs to a Series: with 2+ published members. */
+.series-nav {
+  max-width: 760px;
+  margin: 20px auto;
+  padding: 14px 22px;
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  border-left: 3px solid var(--accent);
+  border-radius: 8px;
+}
+.series-nav-title { margin: 0 0 6px; color: var(--fg); }
+.series-nav ol { margin: 0; padding-left: 22px; }
+.series-nav li { margin: 2px 0; line-height: 1.5; }
+.series-nav a { color: var(--accent); }
+.series-nav [aria-current="page"] { font-weight: 600; color: var(--fg); }
diff --git a/content/trust-decay-adversarial-hiring.md b/content/trust-decay-adversarial-hiring.md
index 70f3d899..04960c57 100644
--- a/content/trust-decay-adversarial-hiring.md
+++ b/content/trust-decay-adversarial-hiring.md
@@ -3,6 +3,7 @@ Date: 2026-05-04
 Modified: 2026-06-04
 Category: DevSecOps
 Tags: careers, devsecops
+Series: Hiring as an Adversarial System
 Slug: trust-decay-adversarial-hiring
 Og_image: images/og/trust-decay-adversarial-hiring.png
 Author: Oliver Rivas
diff --git a/themes/Flex/templates/article.html b/themes/Flex/templates/article.html
index d4b13787..0003e3d6 100644
--- a/themes/Flex/templates/article.html
+++ b/themes/Flex/templates/article.html
@@ -50,6 +50,8 @@ <h1 id="{{ article.slug }}" itemprop="headline">{{ article.title }}</h1>
     </p>
   </header>
 
+  {% include "partial/series_nav.html" %}
+
   {% if article.toc %}
   <aside class="article-toc" aria-label="Table of contents">
     <details open>
diff --git a/themes/Flex/templates/partial/series_nav.html b/themes/Flex/templates/partial/series_nav.html
new file mode 100644
index 00000000..b238a470
--- /dev/null
+++ b/themes/Flex/templates/partial/series_nav.html
@@ -0,0 +1,28 @@
+{# Series navigation: posts sharing a `Series:` frontmatter value get an
+   ordered part list (by date). Computed from `articles`, which contains only
+   PUBLISHED posts - a draft member never renders a link, and the box hides
+   itself entirely until a series has at least two published parts. These are
+   structural navigation links generated at build time, not in-body editorial
+   links, so they are invisible to check_link_graph.py's outbound cap. #}
+{% set series_name = article.metadata.get('series') %}
+{% if series_name %}
+  {% set parts = articles | selectattr('metadata.series', 'defined')
+                          | selectattr('metadata.series', 'equalto', series_name)
+                          | sort(attribute='date') | list %}
+  {% if parts | length > 1 %}
+<aside class="series-nav" aria-label="Series: {{ series_name }}">
+  <p class="series-nav-title">Series: <strong>{{ series_name }}</strong></p>
+  <ol>
+    {% for p in parts %}
+    <li>
+      {% if p.slug == article.slug %}
+      <span aria-current="page">{{ p.title|striptags }}</span>
+      {% else %}
+      <a href="{{ SITEURL }}/{{ p.url }}">{{ p.title|striptags }}</a>
+      {% endif %}
+    </li>
+    {% endfor %}
+  </ol>
+</aside>
+  {% endif %}
+{% endif %}