diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 21e598a..e7a7521 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -22,6 +22,14 @@ jobs:
   # no checks at all, so the required context could never be satisfied and every
   # PR was permanently unmergeable.
   check:
+    # Hosted, and deliberately not routed through `vars.GH_RUNNER` the way the
+    # private repos are: this repository is public, so a fork PR would run on
+    # the self-hosted fleet -- executing arbitrary contributor code on hardware
+    # we own, where it can also persist and poison later trusted jobs. Nothing
+    # is given up by staying hosted: standard GitHub-hosted runners are free
+    # and unlimited on public repos, macOS and Windows included. Only *larger*
+    # runners are billed, so do not "upgrade" a job to one.
+    # https://docs.github.com/en/billing/reference/actions-runner-pricing
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4