diff --git a/bin/tcfeed.ts b/bin/tcfeed.ts
index 8819023..ee64dbd 100755
--- a/bin/tcfeed.ts
+++ b/bin/tcfeed.ts
@@ -1063,12 +1063,20 @@ const prBody = (spec: string, issue: string, ran: string): string =>
     'so contributor code never executes with your secrets in scope. The SARIF upload',
     'is `continue-on-error` and degrades quietly where code scanning is unavailable.',
     '',
-    `The CLI is pinned to \`${spec}\` and installed with`,
-    '`--ignore-scripts`, and checkout runs with `persist-credentials: false`. A',
-    "scanner that installs a floating version, runs its dependencies' lifecycle",
-    'scripts and leaves a token in `.git/config` is asking you to trust more than it',
-    'is worth, and none of that is needed to read a diff. Bump the pin whenever you',
-    'like — nothing here updates itself.',
+    `The CLI is pinned to \`${spec}\`, and the workflow does not install it on the`,
+    "registry's word. It downloads that tarball, hashes it, checks the SHA-512",
+    'against a value committed in the workflow file, and refuses to install on a',
+    'mismatch. A pinned version says which release to fetch; it does not say the',
+    'bytes are the ones that release was published with, and the party answering the',
+    'first question is the party serving the bytes. You can check the pinned hash',
+    `against the registry yourself with \`npm view ${spec} dist.integrity\`.`,
+    '',
+    'It installs with `--ignore-scripts`, and checkout runs with',
+    "`persist-credentials: false`. A scanner that installs a floating version, runs",
+    "its dependencies' lifecycle scripts and leaves a token in `.git/config` is",
+    'asking you to trust more than it is worth, and none of that is needed to read a',
+    'diff. Bump the pin and its hash together whenever you like — nothing here',
+    'updates itself.',
     '',
     'Disclosure: I maintain [ThreatCrush](https://github.com/profullstack/threatcrush).',
     'It is free and MIT, and the workflow installs it from npm — nothing here phones',