diff --git a/.gitea/workflows/README.md b/.gitea/workflows/README.md
index ebc2955..e497ce9 100644
--- a/.gitea/workflows/README.md
+++ b/.gitea/workflows/README.md
@@ -164,11 +164,14 @@ Cost: the job shares the single act_runner slot with the gate, but the build its
 .gitea/workflows/
   merge-gate.yaml            the pipeline (lint → l0 → l1 → conformance → decision)
   images.yaml                build/verify/publish this repo's container images (see above)
+  cve-triage.yaml            scheduled CVE triage bot (R-VULN-05/07, ADR-0027; runs before Renovate)
   scripts/
     install-tools.sh         installs the pinned tools per stage (from ci/versions.env) — used by the
                              dormant merge-gate.yaml blueprint only; gate.yml runs in the toolbox image
     decide.sh                the R-TEST-03 merge decision over job results
     images.sh                the image pipeline's driver (what to build, base, push, digest)
+    cve_triage.py            the CVE triage bot: reads the scanner report, maintains the counts-only
+                             CVE Dashboard issue, ticks Renovate approval rows (cve-triage.yaml)
   README.md                  this file
 ```