diff --git a/cicd.md b/cicd.md
index 6c8f12a..6a1679d 100644
--- a/cicd.md
+++ b/cicd.md
@@ -142,7 +142,7 @@ IAM role `githubdeploy-<repo>`, owned by workload Terraform.
 - `job_workflow_ref`: `Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*` (and `cd-hcp-spa.yaml`)
 - `workflow_ref`: the thin caller still `Sea-Haven-Industries/<repo>/.github/workflows/deploy-api.yaml@refs/heads/main` and `@refs/tags/v*`
 
-Adding an app adds `workflow_ref` for that caller. Do not pin trust to only `ref:refs/heads/main`.
+Adding an app still adds `workflow_ref` for that caller. Do not pin trust to only `ref:refs/heads/main`.
 
 **Permissions.** Only what the workflows write: