diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 30ae7b22..c6511169 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -116,6 +116,8 @@ jobs:
       # upload-assets job declares it, and a reusable workflow's job
       # permissions may not exceed the caller's, or the run fails at startup.
       contents: write
+    # The generator must be referenced by an exact vX.Y.Z tag rather than
+    # pinned by hash, or slsa-verifier can't verify the generator's ref.
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
     with:
       base64-subjects: ${{ needs.build.outputs.hashes }}