diff --git a/README.md b/README.md
index 7a58da8..29f3cea 100644
--- a/README.md
+++ b/README.md
@@ -4,10 +4,11 @@
 
 # go-tokenless
 
+<!-- Scorecard URLs are case-sensitive: keep the org login "Continuous-Actions". -->
 [![CI](https://github.com/continuous-actions/go-tokenless/actions/workflows/ci.yml/badge.svg)](https://github.com/continuous-actions/go-tokenless/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/go-tokenless?logo=npm)](https://www.npmjs.com/package/go-tokenless)
 [![MCP Registry](https://img.shields.io/badge/MCP_Registry-go--tokenless-blue)](https://registry.modelcontextprotocol.io/v0/servers?search=go-tokenless)
-[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/continuous-actions/go-tokenless/badge)](https://scorecard.dev/viewer/?uri=github.com/continuous-actions/go-tokenless)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Continuous-Actions/go-tokenless/badge)](https://scorecard.dev/viewer/?uri=github.com/Continuous-Actions/go-tokenless)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 
 **Delete your `NPM_TOKEN`.** One command switches npm publishing in GitHub Actions to [trusted publishing](https://docs.npmjs.com/trusted-publishers) (OIDC). No long-lived token is stored anywhere, and every release gets a provenance badge.