diff --git a/.github/workflows/scan-secret.yml b/.github/workflows/scan-secret.yml
index 2be359e..c1d1c87 100644
--- a/.github/workflows/scan-secret.yml
+++ b/.github/workflows/scan-secret.yml
@@ -88,6 +88,14 @@ jobs:
                 echo "| [\`${sha:0:12}\`](${repository_url}/commit/${sha}) | ${missing_types[$index]} | ${subject} |"
               done
 
+              echo
+              echo "## How it works"
+              echo
+              echo "Eacgh repository includes Betterleaks Git hooks in \`.githooks\`. Enable them by configuring Git's \`core.hooksPath\` to use that directory."
+              echo
+              echo "Before each commit, the \`pre-commit\` hook runs Betterleaks against the staged changes. If the scan passes, the \`prepare-commit-msg\` hook adds the \`betterleaks-Scan: passed\` trailer to the commit message as proof that the scan ran successfully. If Betterleaks detects a secret, the commit is blocked."
+              echo
+              echo "A commit without the required trailer was created without a successful hook scan, usually because the hooks were not enabled when that commit was made. The affected commits must therefore be replayed and amended after the hooks are enabled, causing Betterleaks to scan them and add the trailer."
               echo
               echo "## How to fix"
               echo