diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
index 7e14fc1..968a2e3 100644
--- a/.github/workflows/build-iso.yml
+++ b/.github/workflows/build-iso.yml
@@ -41,6 +41,9 @@ jobs:
           df -h
 
       - name: Run build inside Fedora 43 container
+        # v3 is composite/docker-based — no node runtime in the action
+        # itself. Safe under node20 forgejo-runner. TODO(infra): consider
+        # SHA pinning in a follow-up sweep.
         uses: addnab/docker-run-action@v3
         with:
           image: registry.fedoraproject.org/fedora:43