diff --git a/README.md b/README.md
index 68b83ae..3e154b9 100644
--- a/README.md
+++ b/README.md
@@ -221,7 +221,9 @@ The action restores and saves that file on every run, independently of the `cach
 
 Reusing a verdict is not a weaker check: pnpm re-verifies whenever the lockfile content changes, and whenever the recorded policy is looser than the one now configured.
 
-The log is uploaded as soon as the install that produced it finishes, not at the end of the job, so nothing the job runs afterwards — its tests, its build, a dependency's own scripts — can alter what later jobs restore. A job that installs in a step of its own rather than through this action is saved at the end of the job instead, since that is the first moment the log is known to be complete.
+The log is uploaded as soon as the install that produced it finishes, not at the end of the job, so nothing the job runs afterwards — its tests, its build, any later step — can alter what other jobs restore. Dependency lifecycle scripts are the exception, since they run inside the install itself, ahead of the upload: pnpm refuses to run them unless the repository allow-lists the package through `allowBuilds`, and a package on that list can already run code in the job.
+
+A job that installs in a step of its own rather than through this action is saved at the end of the job instead, since that is the first moment the log is known to be complete.
 
 ### Cache dependencies from multiple lockfiles
 
diff --git a/src/lockfile-verification-cache/index.ts b/src/lockfile-verification-cache/index.ts
index 6414e78..43bc6f6 100644
--- a/src/lockfile-verification-cache/index.ts
+++ b/src/lockfile-verification-cache/index.ts
@@ -60,9 +60,11 @@ export async function restoreVerificationCache(lockfileHash: string): Promise<vo
 
 /**
  * Uploaded as soon as the install that produced the log finishes, rather than
- * at the end of the job: whatever a job runs after installing — its tests, its
- * build, a dependency's own scripts — can rewrite the log on disk, and the
- * job's own cache write would then publish that for later jobs to trust.
+ * at the end of the job: whatever a job runs after installing can rewrite the
+ * log on disk, and the job's own cache write would then publish that for later
+ * jobs to trust. Lifecycle scripts of the installed packages stay inside the
+ * window — they run during the install — but pnpm only runs those the
+ * repository has allow-listed.
  *
  * Safe to call more than once; the second call is a no-op.
  */