diff --git a/python/exporter/cli.py b/python/exporter/cli.py
index 1dde0c17..41e41319 100644
--- a/python/exporter/cli.py
+++ b/python/exporter/cli.py
@@ -116,8 +116,8 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help=(
             "Write a plain zip. The bundle is locked with a generated code by default, because it"
-            " holds keys that cannot be revoked - but no OpenTagViewer release can open a locked"
-            " one yet."
+            " holds keys that cannot be revoked - but no released version of the Android app can"
+            " open a locked one yet, so a bundle for somebody else needs this."
         ),
     )
     parser.add_argument(
diff --git a/python/exporter/wizard.py b/python/exporter/wizard.py
index 0e45ef51..2158b99f 100644
--- a/python/exporter/wizard.py
+++ b/python/exporter/wizard.py
@@ -564,9 +564,18 @@ def _export(self) -> None:
             messagebox.showerror("That selection cannot be exported", str(e))
             return
 
-        # No password from the window yet: nothing that imports these can open a locked one, so
-        # offering it here would produce a file the recipient cannot use. See the CLI's
-        # --no-password, and docs/android-import-handover.md.
+        # **No password yet, and the reason is release ordering rather than a missing feature.**
+        # The app on `main` imports locked bundles - zip4j is in `app/build.gradle.kts` and
+        # `AppleZipImporterUtil` uses it - but no *released* APK does: the newest is 1.0.5, from
+        # before that work, and `versionName` has not moved past it.
+        #
+        # So locking bundles now would produce files that nobody's installed app can open, and the
+        # people worst affected would be recipients, who did not choose the exporter's version and
+        # cannot fix it from their side.
+        #
+        # **What unblocks this is an Android release containing zip4j, not a change here.** Once
+        # one exists, this becomes a decision about how long to keep supporting the versions before
+        # it. See the CLI's --no-password, and docs/android-import-handover.md.
         write_zip(bundle, path, password=None)
 
         messagebox.showinfo(