diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index e90931d0..4aa317fc 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -56,10 +56,14 @@ jobs:
         with:
           persist-credentials: false
       # Install the PREBUILT binary, never `cargo install` (build-from-source):
-      # the repo pins rustc 1.96 (rust-toolchain.toml), but the current
-      # cargo-audit release needs >= 1.88 to COMPILE. The prebuilt binary RUNS
-      # fine under any toolchain — it only parses Cargo.lock, it never compiles
-      # the project — so the toolchain pin is irrelevant to it.
+      #  1. compiling the tool on every run dwarfs downloading it, and
+      #  2. `rust-toolchain.toml` is a directory override, so a build-from-source
+      #     install is subject to this repo's rustc pin -- if a tool's own MSRV
+      #     ever rises above that pin, the SECURITY gate is what breaks. The
+      #     prebuilt binary only parses `Cargo.lock` and runs under any toolchain.
+      # Reason 2 was an ACTIVE constraint until the v1.3.0 pin bump (1.86 vs
+      # cargo-audit's 1.88); it is slack today and can bind again after an MSRV
+      # change in either direction, so it is kept rather than deleted as history.
       - uses: taiki-e/install-action@v2.86.1
         with:
           tool: cargo-audit
@@ -72,9 +76,9 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      # Prebuilt binary for the same reason as the audit job: the latest
-      # cargo-deny needs rustc >= 1.88 to build from source, while the repo is
-      # pinned to 1.96. Policy lives in `deny.toml`.
+      # Prebuilt binary for the same two reasons as the audit job above: it is
+      # much faster than compiling cargo-deny, and it keeps the security gate
+      # independent of this repo's rustc pin. Policy lives in `deny.toml`.
       - uses: taiki-e/install-action@v2.86.1
         with:
           tool: cargo-deny
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 675ab4ac..283ed840 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,12 @@ cycle-accurate core later replaced.
 
 ### Fixed
 
+- **Corrected a stale comment in `security.yml`.** It justified installing
+  `cargo-audit` / `cargo-deny` as prebuilt binaries with "the repo pins rustc
+  1.96 **but** cargo-audit needs >= 1.88 to compile" — which argues against
+  itself, since 1.96 satisfies that. True when written at a 1.86 pin; it
+  survived the v1.3.0 bump. Comments only; no behaviour change.
+
 - **The browser demo applied no per-game header corrections.** Every mapper,
   submapper and region fix the vendored game database ships was silently absent
   on the web build — Seicross, which needs submapper 4 to clear its protection