diff --git a/SECURITY.md b/SECURITY.md
index f91de0ba..b5f9b030 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,13 +2,16 @@
 
 ## Supported versions
 
-The project has not yet cut a versioned release. Security fixes are applied directly on `main` against the current development snapshot.
+Security fixes land on `main` and ship in the next release from the current minor line. Older lines
+are not patched retroactively: the three artifacts (`srcmorph`, `srcmorph-cli`,
+`srcmorph-maven-plugin`) are released together from one parent pom at a single version, so upgrading
+within a line is a version bump and nothing else.
 
 | Version | Supported |
 |---------|-----------|
-| 0.1.0-SNAPSHOT (development, unreleased) | Security fixes applied on `main` |
-
-> Note: once the first SemVer release is cut, this table will be updated to list the supported release line(s).
+| 1.2.x (current release line) | ✅ Security fixes released from `main` |
+| 1.1.x and older | ❌ Upgrade to the current line |
+| `main` (development) | ✅ Fixes land here first |
 
 ---
 
diff --git a/docs/RELEASE.md b/docs/RELEASE.md
index 8aa98a24..07f5f0b6 100644
--- a/docs/RELEASE.md
+++ b/docs/RELEASE.md
@@ -15,6 +15,18 @@ procedure:
    (No `-Dexcludes` needed — the reactor's former 4th module, a relocation-stub POM for the
    retired `net.ladenthin:llamacpp-ai-index-maven-plugin` coordinates, was removed after its one
    `1.0.4` release; see `CLAUDE.md`.)
+
+   **`versions:set` rewrites only the poms.** These version literals are hand-maintained and must be
+   bumped in the same commit, or the published docs point consumers at the previous release:
+   - `README.md` — the `<dependency>`/`<plugin>` snippets **and** the "Current reactor version /
+     Last released version" line;
+   - `srcmorph-maven-plugin/README.md` — its own `<plugin>` snippet;
+   - `CLAUDE.md` — the reactor version and "Last released version" in the overview and layout blocks;
+   - `SECURITY.md` — the supported-release-line table;
+   - `CHANGELOG.md` — the `## [X.Y.Z] - <date>` heading and the two link refs at the bottom.
+
+   `grep -rn "<previous version>" --include="*.md" .` finds what was missed; run it before tagging,
+   not after.
 2. **Commit, push, merge to `main`.**
 3. **Tag the merge commit and push the tag:**
    ```bash