diff --git a/.github/workflows/portal-ci.yml b/.github/workflows/portal-ci.yml
index adc3c60..75a26f2 100644
--- a/.github/workflows/portal-ci.yml
+++ b/.github/workflows/portal-ci.yml
@@ -20,6 +20,7 @@ jobs:
         working-directory: ./portal
     steps:
       - uses: actions/checkout@v4
+      # PROJECT_ATLAS_SSH_PRIVATE_KEY must be a read-only deploy key for git@gitea.d-bis.org:Sankofa_Phoenix/projectAtlas.git
       - name: Bootstrap Project Atlas submodule
         env:
           PROJECT_ATLAS_SSH_PRIVATE_KEY: ${{ secrets.PROJECT_ATLAS_SSH_PRIVATE_KEY }}
@@ -40,6 +41,7 @@ jobs:
         working-directory: ./portal
     steps:
       - uses: actions/checkout@v4
+      # PROJECT_ATLAS_SSH_PRIVATE_KEY must be a read-only deploy key for git@gitea.d-bis.org:Sankofa_Phoenix/projectAtlas.git
       - name: Bootstrap Project Atlas submodule
         env:
           PROJECT_ATLAS_SSH_PRIVATE_KEY: ${{ secrets.PROJECT_ATLAS_SSH_PRIVATE_KEY }}
@@ -60,6 +62,7 @@ jobs:
         working-directory: ./portal
     steps:
       - uses: actions/checkout@v4
+      # PROJECT_ATLAS_SSH_PRIVATE_KEY must be a read-only deploy key for git@gitea.d-bis.org:Sankofa_Phoenix/projectAtlas.git
       - name: Bootstrap Project Atlas submodule
         env:
           PROJECT_ATLAS_SSH_PRIVATE_KEY: ${{ secrets.PROJECT_ATLAS_SSH_PRIVATE_KEY }}
@@ -85,6 +88,7 @@ jobs:
         working-directory: ./portal
     steps:
       - uses: actions/checkout@v4
+      # PROJECT_ATLAS_SSH_PRIVATE_KEY must be a read-only deploy key for git@gitea.d-bis.org:Sankofa_Phoenix/projectAtlas.git
       - name: Bootstrap Project Atlas submodule
         env:
           PROJECT_ATLAS_SSH_PRIVATE_KEY: ${{ secrets.PROJECT_ATLAS_SSH_PRIVATE_KEY }}
diff --git a/scripts/ci/bootstrap-project-atlas-submodule.sh b/scripts/ci/bootstrap-project-atlas-submodule.sh
index ef93efb..5670186 100755
--- a/scripts/ci/bootstrap-project-atlas-submodule.sh
+++ b/scripts/ci/bootstrap-project-atlas-submodule.sh
@@ -7,6 +7,8 @@ submodule_path="${PROJECT_ATLAS_SUBMODULE_PATH:-portal/src/data/project-atlas}"
 ssh_key="${PROJECT_ATLAS_SSH_PRIVATE_KEY:-}"
 key_file="${RUNNER_TEMP:-/tmp}/project-atlas-submodule-key"
 
+# The Project Atlas submodule lives in Gitea and must be fetched with a
+# read-only deploy key stored in PROJECT_ATLAS_SSH_PRIVATE_KEY.
 if git -C "$repo_root" submodule status -- "$submodule_path" | grep -q '^-'; then
   if [[ -z "$ssh_key" ]]; then
     echo "PROJECT_ATLAS_SSH_PRIVATE_KEY is required to initialize the private projectAtlas submodule." >&2