diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 0467ea8..4ed64e2 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -3,9 +3,16 @@
 # audited like any other code.
 #
 # It is not everything this repository executes, and this audit does not reach the
-# rest. Two tracked shell scripts carry the rules of the document check and the
-# hygiene check, a workflow runs each of them on a pull request, and no analyser
-# for their language is configured anywhere in this tree. #81 holds that gap.
+# rest. Tracked shell scripts carry the rules of the document check and the hygiene
+# check, and a workflow runs each of them on a pull request. Their language is read
+# by .github/workflows/shell-analysis.yml, which landed under #81 and is a separate
+# leg rather than a setting here: putting a second analyser over the workflow YAML
+# this one already reads is an argument nobody has made.
+#
+# What #81 still holds is the analysis over the core's own language, which waits on
+# #11 because no code is in this tree, and an upload of the shell findings to the
+# code-scanning tab, which that leg does not do. How many shell scripts there are
+# moves whenever one lands, so it is not counted here.
 #
 # The gate runs zizmor's regular persona at --min-severity=low: it fails the
 # build on any actionable (low/medium/high/critical) security finding -