diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7fac50403d..71bc079342 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,3 +1,4 @@
+# workflow-hardening: 1 finding needs manual review — see PR description
 name: Release build
 on:
   push:
diff --git a/.github/workflows/semantic-check.yml b/.github/workflows/semantic-check.yml
index e6d95656b9..6e03dda83a 100644
--- a/.github/workflows/semantic-check.yml
+++ b/.github/workflows/semantic-check.yml
@@ -1,3 +1,4 @@
+# workflow-hardening: 1 finding needs manual review — see PR description
 name: "Semantic Check"
 on:
   pull_request_target: