diff --git a/docs/tools/hivectl-cli.md b/docs/tools/hivectl-cli.md
index 624ddddf..645eb377 100644
--- a/docs/tools/hivectl-cli.md
+++ b/docs/tools/hivectl-cli.md
@@ -12,6 +12,7 @@ This document contains the help content for the `hivectl` command-line program.
 * [`hivectl matrix sync-admin`↴](#hivectl-matrix-sync-admin)
 * [`hivectl matrix promote-user`↴](#hivectl-matrix-promote-user)
 * [`hivectl matrix reset-password`↴](#hivectl-matrix-reset-password)
+* [`hivectl matrix invite`↴](#hivectl-matrix-invite)
 * [`hivectl gateway`↴](#hivectl-gateway)
 * [`hivectl gateway create-user`↴](#hivectl-gateway-create-user)
 * [`hivectl gateway delete-user`↴](#hivectl-gateway-delete-user)
@@ -84,6 +85,7 @@ matrix-tuwunel user provisioning. Manual entry point to the same idempotent flow
 * `sync-admin` — Provision (or re-provision) the hive system admin matrix account (`@hive:<server>`). hive-c0re runs this automatically on startup before the agent sweep so the account is the first registered user — Conduit/tuwunel grants admin rights to the first user. Run manually to recover a missing admin token file
 * `promote-user` — Promote a matrix user to homeserver admin via the admin API. Uses the hive system admin token at `/var/lib/hyperhive/matrix-admin-token`. The `server_name` is discovered automatically from the running homeserver
 * `reset-password` — Reset a matrix user's password via the admin API and persist the new password to `/var/lib/hyperhive/matrix-creds/<name>-password` so the next `ensure_user_for` (or `create-user`) can re-login
+* `invite` — Invite a matrix user to the hive Space (default) or a specific room. Uses the hive admin token; the admin account must be a member of the target room with invite power (it owns the hive Space). Idempotent — already-member / already-invited is a no-op
 
 
 
@@ -144,6 +146,22 @@ After this command succeeds, run `hivectl matrix create-user <name>` to mint a f
 
 
 
+## `hivectl matrix invite`
+
+Invite a matrix user to the hive Space (default) or a specific room. Uses the hive admin token; the admin account must be a member of the target room with invite power (it owns the hive Space). Idempotent — already-member / already-invited is a no-op
+
+**Usage:** `hivectl matrix invite [OPTIONS] <USER>`
+
+###### **Arguments:**
+
+* `<USER>` — User to invite: a full id (`@mara:server`) or a bare localpart (qualified with the homeserver's `server_name`)
+
+###### **Options:**
+
+* `--room <ROOM>` — Target room id (`!abc:server`) or alias (`#name:server`). Omit to invite to the hive Space
+
+
+
 ## `hivectl gateway`
 
 Gateway htpasswd user management. Add, remove, or list users in an htpasswd file used by the gateway's HTTP Basic auth (`services.hyperhive.gateway.auth`). Credentials are stored as `BCrypt` hashes — no extra service or PAM required