diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2951066..74a9203 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,10 +3,10 @@
 # This workflow runs on every pull request and push to main/develop branches.
 # It performs comprehensive quality checks before allowing code to be merged.
 #
-# Required GitHub Secrets: None (all checks run without cloud credentials)
+# Required GitHub Secrets: None (all checks run without cloud credentials).
+# Optional: SNYK_TOKEN enables the non-gating Snyk scan.
 #
-# Required GitHub Variables:
-#   - GO_VERSION: Go version to use (default: 1.26.9)
+# Required GitHub Variables: None
 #
 # Triggered by:
 #   - Pull requests to main/develop
@@ -25,9 +25,6 @@ on:
     branches: [main, develop]
   workflow_dispatch:
 
-env:
-  GO_VERSION: '1.26.9'
-
 jobs:
   lint:
     name: Lint Code
@@ -504,6 +501,9 @@ jobs:
         with:
           go-version-file: go.mod
 
+      # Non-gating on purpose: Snyk is an external service, so its outages or
+      # rate limits must not block merges. It is deliberately absent from
+      # ci-success.needs.
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/golang@9adf32b1121593767fc3c057af55b55db032dc04 # 1.0.0
         continue-on-error: true