diff --git a/.github/workflows/socket-basics.yml b/.github/workflows/socket-basics.yml
index 1cd8574..5ddf328 100644
--- a/.github/workflows/socket-basics.yml
+++ b/.github/workflows/socket-basics.yml
@@ -6,6 +6,10 @@ on:
 
 jobs:
   socket-basics-security-scan:
+    # We intentionally run this shared action from @main, not from a pinned sha
+    # this is because we control the ynab-sast-scanner repo, so there is not a significant risk of malicious changes being pushed.
+    # Plus, the shared action does use pinned dependencies, and so will be updated fairly often.  When we do that, we do not
+    # want to have to update the sha in every repo that uses this shared action, before such updates apply.
     uses: ynab/ynab-sast-scanner/.github/workflows/socket-basics.yml@main
     secrets:
       SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}