diff --git a/SECURITY.md b/SECURITY.md
index 04c37da5..b70d2ba5 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -25,10 +25,11 @@ maintained by volunteers, so timelines for fixes vary with severity.
 This policy covers the site source, build scripts, and GitHub Actions workflows
 in this repository. [Dependabot](.github/dependabot.yml) opens pull requests for
 routine npm and GitHub Actions version updates, and
-[CodeQL](.github/workflows/codeql.yml) scans the JavaScript/TypeScript source on
-pushes to main, pull requests, and a weekly schedule. Report all vulnerabilities
-in third-party dependencies here, including ones with no fixed version available
-yet.
+[CodeQL](.github/workflows/codeql.yml) scans the JavaScript/TypeScript source
+and the GitHub Actions workflows (the `actions` language) on pushes to main,
+pull requests that touch either, and a weekly schedule. Report all
+vulnerabilities in third-party dependencies here, including ones with no fixed
+version available yet.
 
 ## Known unpatched dependency advisories