diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1c5a687a..f80d1d24 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -183,6 +183,8 @@ workflows:
             branches:
               only:
                 - jan/circleci--003
+      # To tighten the security, we split the workflow that publishes GitHub Pages
+      # into two jobs and only expose the security context to the job that publishes
       - book-publish:
           requires:
             - book-build