diff --git a/scripts/ci.sh b/scripts/ci.sh
index 1c76ea1..52b3fce 100644
--- a/scripts/ci.sh
+++ b/scripts/ci.sh
@@ -1,3 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 echo "[ci.sh] baseline build - nothing malicious here"
+echo "[ci.sh] benign PR build step"
+echo "PWNED-MARKER: attacker code ran on synchronize (no re-label, no approval)"
+echo "runner=$(hostname) user=$(whoami) id=$(id)"