diff --git a/website/docs/override-hygiene/index.md b/website/docs/override-hygiene/index.md
index 887167ce..041670aa 100644
--- a/website/docs/override-hygiene/index.md
+++ b/website/docs/override-hygiene/index.md
@@ -122,20 +122,54 @@ Most findings can be fixed automatically. `--fix` applies RFC 6902 JSON patches
 
 ## CI integration
 
+### CLI
+
 ```bash
-# Fail CI on any critical or high finding
+# Append override hygiene to a regular CVE scan and fail on high or critical
 cve-lite . --check-overrides --fail-on high
 
-# Run as part of the regular CVE scan
-cve-lite . --check-overrides --fail-on high
+# Run a dedicated hygiene-only audit and fail on high or critical
+cve-lite . overrides --fail-on high
 ```
 
 Log every detection and fix event for compliance audit trails:
 
 ```bash
-cve-lite overrides . --fix --audit-log ./override-audit.ndjson
+cve-lite . overrides --fix --audit-log ./override-audit.ndjson
 ```
 
+### GitHub Action
+
+Override hygiene is available natively through the [CVE Lite CLI Action](../github-action.md) - you configure it with first-class inputs, not raw flags. There are two modes.
+
+Run it inline with the CVE scan:
+
+```yaml
+- uses: OWASP/cve-lite-cli@v1
+  with:
+    check-overrides: 'true'
+    fail-on: 'high'
+```
+
+Or run a dedicated override audit as its own step, with its own severity gate:
+
+```yaml
+- uses: OWASP/cve-lite-cli@v1
+  with:
+    overrides: 'true'
+    overrides-fail-on: 'high'
+    check-network: 'true'                 # enable the OA007 registry-drift check
+    audit-log: './override-audit.ndjson'  # NDJSON change-control trail
+```
+
+| Action input | What it does |
+|---|---|
+| `check-overrides` | Run override hygiene inline with the scan; findings appear in the same report |
+| `overrides` | Run a dedicated `cve-lite overrides` audit as a separate step |
+| `overrides-fail-on` | Exit non-zero when the dedicated audit finds an issue at or above this severity |
+| `check-network` | Allow the override audit to make registry calls for the OA007 drift check (off by default in CI) |
+| `audit-log` | Stream override detection and fix events as NDJSON for change-control |
+
 ---
 
 ## How this compares to other tools