diff --git a/.auths/allowed_signers b/.auths/allowed_signers
index 21d68016ffb..34d0a6587c0 100644
--- a/.auths/allowed_signers
+++ b/.auths/allowed_signers
@@ -12,11 +12,12 @@
 #   <DID>@auths.local namespaces="git" ssh-ed25519 <base64-public-key>
 #
 # To add your key:
-#   1. Install Auths:    pip install auths
-#   2. Create identity:  auths init
-#   3. Configure Git:    auths git setup
-#   4. Export signers:   auths git allowed-signers --output .auths/allowed_signers
-#   5. Commit and push this file
+#   1. Install Auths CLI:
+#       Homebrew: brew tap auths-dev/auths-cli && brew install auths
+#       Cargo:    cargo install auths_cli
+#   2. Create identity:   auths init
+#   3. Export signers:    auths signers sync --output .auths/allowed_signers
+#   4. Commit and push this file
 #
 # Documentation: https://github.com/auths-dev/auths/blob/main/docs/guides/platforms/ci-cd.md
 #
diff --git a/.github/workflows/auths-verify-commits.yml b/.github/workflows/auths-verify-commits.yml
index bc66c723448..6e957fe3cbd 100644
--- a/.github/workflows/auths-verify-commits.yml
+++ b/.github/workflows/auths-verify-commits.yml
@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
 
       - name: Verify commits with Auths
-        uses: auths-dev/auths-verify-github-action@v1 # TODO: pin to SHA once stable
+        uses: auths-dev/auths-verify-github-action@57e304ef368d30474e5b6a04106cacde6a8ce492 # v1
         with:
           allowed-signers: .auths/allowed_signers
           fail-on-unsigned: 'false'
diff --git a/cookbook/security/README.md b/cookbook/security/README.md
index 7bc468507c5..5fd746bb0f2 100644
--- a/cookbook/security/README.md
+++ b/cookbook/security/README.md
@@ -26,7 +26,7 @@ The simulation script recreates the attack scenario and demonstrates how Auths
 verification catches the unauthorized commit:
 
 ```bash
-pip install auths
+brew tap auths-dev/auths-cli && brew install auths
 python auths_attack_simulation.py
 ```
 
diff --git a/cookbook/security/auths_attack_simulation.py b/cookbook/security/auths_attack_simulation.py
index 3505ada8988..e24deda12a8 100644
--- a/cookbook/security/auths_attack_simulation.py
+++ b/cookbook/security/auths_attack_simulation.py
@@ -19,7 +19,7 @@ Why Auths prevents this:
   without the maintainer's private key stored in their device keychain.
 
 Usage:
-  pip install auths
+  brew tap auths-dev/auths-cli && brew install auths
   python auths_attack_simulation.py
 """
 import os
@@ -124,7 +124,8 @@ def main() -> None:
         print("The 'auths' CLI is not installed.")
         print()
         print("Install it with:")
-        print("  pip install auths")
+        print("  brew tap auths-dev/auths-cli && brew install auths")
+        print("  (or: cargo install auths_cli)")
         print()
         print("Or visit: https://github.com/auths-dev/auths")
         sys.exit(0)