diff --git a/.github/actions/publish-to-s3/action.yml b/.github/actions/publish-to-s3/action.yml
index c52bcc6..70bb531 100644
--- a/.github/actions/publish-to-s3/action.yml
+++ b/.github/actions/publish-to-s3/action.yml
@@ -62,7 +62,7 @@ inputs:
     required: false
     default: ""
   dry-run:
-    description: Show what would be uploaded and invalidated, and change nothing.
+    description: Dry run. Show what would be uploaded and invalidated, and change nothing.
     required: false
     default: "false"
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 21b9bb2..90452ca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,13 @@ what moved. See
 
 ## [Unreleased]
 
+### Changed
+
+- `publish-to-s3`'s `dry-run` description now says "dry run". It described the
+  behavior without naming it, so anyone scanning for the term — including in a
+  `workflow_dispatch` checkbox, where GitHub shows only the description — did
+  not find it.
+
 ## [1.2.0] - 2026-09-02
 
 ### Added
diff --git a/README.md b/README.md
index 4136b60..c39e9a8 100644
--- a/README.md
+++ b/README.md
@@ -254,7 +254,7 @@ work for another until an entry is added.
 | `distribution-id` | — | CloudFront distribution to invalidate; omit to skip |
 | `acl` | `none` | AWS recommends ACLs disabled. Set to `public-read` for a legacy bucket with no policy |
 | `public-base-url` | — | Public URL serving the published objects. When set, the summary links every published file and one is fetched afterwards to confirm it is readable |
-| `dry-run` | `false` | Show what would happen and change nothing |
+| `dry-run` | `false` | Dry run. Show what would be uploaded and invalidated, and change nothing |
 
 Run it with `dry-run: true` first. It refuses to publish an empty or missing
 source directory, because a build that "succeeds" into nothing would otherwise