diff --git a/docs/security/architecture-flow.svg b/docs/security/architecture-flow.svg
new file mode 100644
index 0000000..a8c8f5e
--- /dev/null
+++ b/docs/security/architecture-flow.svg
@@ -0,0 +1,37 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 300 500" role="img" aria-label="Поток трафика: Интернет → MikroTik → HAProxy → ACL → бэкенды">
+  <defs>
+    <marker id="arrow" markerWidth="10" markerHeight="7" refX="9" refY="3.5" orient="auto">
+      <polygon points="0,0 10,3.5 0,7" fill="#555"/>
+    </marker>
+  </defs>
+  <style>
+    .box { fill: #f6f8fa; stroke: #24292f; stroke-width: 1.5; }
+    .text { fill: #24292f; font: 14px system-ui, -apple-system, sans-serif; text-anchor: middle; }
+    .edge { stroke: #57606a; stroke-width: 1.5; fill: none; marker-end: url(#arrow); }
+    .edge-label { fill: #57606a; font: 12px system-ui, -apple-system, sans-serif; text-anchor: middle; }
+  </style>
+
+  <rect class="box" x="95" y="10" width="110" height="40" rx="6"/>
+  <text class="text" x="150" y="35">Интернет</text>
+
+  <line class="edge" x1="150" y1="50" x2="150" y2="78"/>
+
+  <rect class="box" x="45" y="78" width="210" height="40" rx="6"/>
+  <text class="text" x="150" y="103">MikroTik / периметр</text>
+
+  <line class="edge" x1="150" y1="118" x2="150" y2="146"/>
+  <text class="edge-label" x="150" y="136">DNAT публичный IP</text>
+
+  <rect class="box" x="20" y="146" width="260" height="40" rx="6"/>
+  <text class="text" x="150" y="171">HAProxy 192.168.160.117 (25 80 443)</text>
+
+  <line class="edge" x1="150" y1="186" x2="150" y2="214"/>
+
+  <rect class="box" x="35" y="214" width="230" height="40" rx="6"/>
+  <text class="text" x="150" y="239">HAProxy ACL: SNI / Host allowlist</text>
+
+  <line class="edge" x1="150" y1="254" x2="150" y2="282"/>
+
+  <rect class="box" x="15" y="282" width="270" height="40" rx="6"/>
+  <text class="text" x="150" y="307">Бэкенды 192.168.160.0/24</text>
+</svg>
diff --git a/docs/security/architecture.md b/docs/security/architecture.md
index e001230..466c938 100644
--- a/docs/security/architecture.md
+++ b/docs/security/architecture.md
@@ -2,21 +2,11 @@
 
 ## Поток трафика
 
-```mermaid
-flowchart TB
-    internet["Интернет"]
-    mt["MikroTik / периметр"]
-    hap["HAProxy 192.168.160.117 (25 80 443)"]
-    acl["HAProxy ACL: SNI / Host allowlist"]
-    backends["Бэкенды 192.168.160.0/24"]
+![Поток трафика](architecture-flow.svg)
 
-    internet --> mt
-    mt -->|DNAT публичный IP| hap
-    hap --> acl
-    acl --> backends
-```
+Схема в SVG — без Mermaid, чтобы Gitea/Firefox не ломали рендер из‑за `<br>` в XML.
 
-Если блок выше не рисуется (старый кеш браузера / Gitea), та же схема текстом:
+Та же схема текстом:
 
 ```text
 Интернет → MikroTik (DNAT) → HAProxy .117 (25/80/443) → ACL (SNI/Host) → бэкенды .160.0/24