diff --git a/docs/ci.md b/docs/ci.md
index 556c5e0a..9b43f675 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -67,7 +67,7 @@ A malicious `default.nix` or build script in a PR can therefore:
 - **Make arbitrary network requests** to any address reachable from the container. The container shares host netns, so `http://127.0.0.1:<forgePort>` is reachable.
 - **Write to the container filesystem**, including corrupting the runner's state dir or `.runner` credentials.
 
-Note: nix *evaluation* (`nix flake check` with `--no-build`) is safer — evaluation is sandboxed at the nix level. Full `nix flake check` (which builds derivations) is not.
+Note: `nix flake check --no-build` (eval-only) reduces the attack surface but does not eliminate it — `builtins.fetchGit`, `builtins.fetchurl`, and import-from-derivation can reach the network and filesystem during evaluation. The default CI workflow runs full `nix flake check` (builds derivations), which is the higher-risk path.
 
 ### Mitigation