diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 976aa48..dd5e60e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -80,6 +80,12 @@ jobs:
     osv-scanner:
         name: OSV Scanner
         # google/osv-scanner-action v2.3.8
+        # NOTE: the repo setting "Require actions pinned to a full-length commit SHA"
+        # is intentionally OFF. v2.3.8's reusable workflow ships an unpinned
+        # actions/download-artifact, which GitHub's SHA-pin enforcement rejects
+        # recursively (breaks this job at startup). Fixed upstream on main
+        # (osv-scanner-action commit f6fb127, not yet in a release). Re-enable the
+        # setting once Dependabot bumps this pin past the next osv-scanner-action release.
         uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2
         with:
             scan-args: |-