diff --git a/website/assets/images/2024-02-01-gvisor-seccomp.png b/website/assets/images/2024-02-01-gvisor-seccomp.png
new file mode 100644
index 000000000..6f0287ffd
Binary files /dev/null and b/website/assets/images/2024-02-01-gvisor-seccomp.png differ
diff --git a/website/blog/2024-02-01-seccomp.md b/website/blog/2024-02-01-seccomp.md
index 49cde09f2..2296af9a6 100644
--- a/website/blog/2024-02-01-seccomp.md
+++ b/website/blog/2024-02-01-seccomp.md
@@ -10,6 +10,12 @@ is actually executed. **This blog post contains more than you ever wanted to
 know about `seccomp-bpf`, and explores the past few months of work to optimize
 gVisor's use of it.**
 
+![gVisor and seccomp](/assets/images/2024-02-01-gvisor-seccomp.png "gVisor and seccomp"){:style="max-width:100%"}
+<span class="attribution">A diagram showing gVisor's two main layers of
+security: gVisor itself, and `seccomp-bpf`. This blog post touches on the
+`seccomp-bpf` part.
+[Tux logo by Larry Ewing and The GIMP](https://commons.wikimedia.org/wiki/File:Tux.svg).</span>
+
 --------------------------------------------------------------------------------
 
 ## Understanding `seccomp-bpf` performance in gVisor {#performance-considerations}