diff --git a/.env.template b/.env.template
index 79465ee..de6cead 100644
--- a/.env.template
+++ b/.env.template
@@ -1,13 +1,14 @@
 # Copy to .env (gitignored); the Makefile loads it automatically.
 
-# GitHub token with contents:write on the repo, for `make release`.
-# Not needed if `gh auth login` was run.
-# GH_TOKEN=
+# GitHub token for `make release` (gh): classic with the `repo` scope, or
+# fine-grained with Contents read/write on simonfranken/submarine.
+GH_TOKEN=
 
 # Optional override (default shown).
 # GITHUB_REPO=simonfranken/submarine
 
-# Bridge release only (`make release-gitea`): token with write:package scope.
+# Bridge release only (`make release-gitea`, see docs/decisions.md D33):
+# Gitea token with the write:package scope. Remove once the bridge is out.
 GITEA_TOKEN=
 # GITEA_URL=https://git.simon-franken.de
 # GITEA_OWNER=simonfranken