diff --git a/.github/workflows/ggshield-scan.yml b/.github/workflows/ggshield-scan.yml
index 25bb5c4..f382a60 100644
--- a/.github/workflows/ggshield-scan.yml
+++ b/.github/workflows/ggshield-scan.yml
@@ -42,7 +42,7 @@ on:
         required: false
     secrets:
       GITGUARDIAN_API_KEY:
-        description: GitGuardian API key (scope `scan`); source of truth in bws Infrastructure.
+        description: GitGuardian API key (scope `scan`); source of truth in Key Vault gitguardian-api-key.
         required: true
 
 jobs:
diff --git a/.github/workflows/komodo-deploy.yml b/.github/workflows/komodo-deploy.yml
index 5dc82c6..cfc7244 100644
--- a/.github/workflows/komodo-deploy.yml
+++ b/.github/workflows/komodo-deploy.yml
@@ -24,7 +24,7 @@
 # auto_update = true as the backstop for a missed trigger.
 #
 # Caller (repo must be granted the org Actions secret KOMODO_WEBHOOK_SECRET;
-# source of truth: bws "Komodo GitHub Webhook Secret"):
+# source of truth: Key Vault komodo-github-webhook-secret):
 #
 #   deploy:
 #     needs: build
@@ -73,7 +73,7 @@ on:
       KOMODO_WEBHOOK_SECRET:
         description: >-
           Komodo Core's shared webhook HMAC secret (org Actions secret; source
-          of truth in bws "Komodo GitHub Webhook Secret").
+          of truth in Key Vault komodo-github-webhook-secret).
         required: true
 
 jobs:
diff --git a/README.md b/README.md
index 0907097..75af90d 100644
--- a/README.md
+++ b/README.md
@@ -82,7 +82,7 @@ jobs:
 ```
 
 Requires the org Actions secret **`GITGUARDIAN_API_KEY`** (scope `scan`; source
-of truth in bws Infrastructure). `secrets: inherit` passes it through — no
+of truth in Key Vault `gitguardian-api-key`). `secrets: inherit` passes it through — no
 per-repo secret needed.
 
 ### `komodo-deploy.yml`
@@ -110,8 +110,8 @@ deploy:
 ```
 
 Requires the org Actions secret **`KOMODO_WEBHOOK_SECRET`** (Komodo Core's
-shared webhook HMAC secret; source of truth in bws "Komodo GitHub Webhook
-Secret") granted to the caller repo. `listener-base` is required by design —
+shared webhook HMAC secret; source of truth in Key Vault
+`komodo-github-webhook-secret`) granted to the caller repo. `listener-base` is required by design —
 this repo is public and carries no estate hostnames. Fire-and-forget: the
 listener 200s and processes async, so keep the stack's `auto_update = true`
 as the backstop. Background: cshuttle/Topology#23 (this fallback) and