diff --git a/README.md b/README.md
index 6cc2cd9..ec999ef 100644
--- a/README.md
+++ b/README.md
@@ -128,10 +128,27 @@ Actions → Build JASP binary and publish to AUR → Run workflow
          jasp_tag = v0.98.1   force = true
 ```
 
-## Caveat worth knowing
+## Where the binary comes from, and how that is disclosed
 
-AUR convention is that a `-bin` package repackages binaries published by upstream.
-Here upstream publishes no Linux binary, so this one is built by us. That is
-unusual, and a maintainer or TU may question it. It is not against the rules, but
-the package description and this README should stay honest about where the binary
-comes from.
+The AUR has no formal "unofficial binary" flag. What it has is the naming rule in
+[AUR submission guidelines](https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submission):
+
+> Packages that use **prebuilt** deliverables, when the sources are available,
+> must use the `-bin` suffix.
+
+That rule is about the deliverable being prebuilt — it says nothing about who
+built it, so `-bin` is the correct and sufficient signal here even though the
+binary is ours rather than upstream's. The two rules that could bite do not:
+JASP is not in any official repository, and the AUR repo carries only `PKGBUILD`
+and `.SRCINFO`, never the makepkg tarball or a filelist.
+
+Disclosure is therefore by convention rather than by mechanism, in the two places
+a user actually looks:
+
+- the **comment header** at the top of the `PKGBUILD` (the same header the
+  guidelines require for maintainer info) states that upstream ships no Linux
+  binary and links to the build pipeline that produced this one;
+- the **`pkgdesc`** ends in `(prebuilt binary)`.
+
+Anyone who wants to verify can read `build/build-jasp.sh` in this repo and
+reproduce the tarball.
diff --git a/packaging/PKGBUILD.in b/packaging/PKGBUILD.in
index 2f86b4b..a6852ce 100644
--- a/packaging/PKGBUILD.in
+++ b/packaging/PKGBUILD.in
@@ -1,9 +1,20 @@
 # Maintainer: @MAINTAINER@
 #
-# Upstream JASP publishes installers for Windows and macOS only. The binary this
-# package installs is therefore not an upstream release artifact: it is built
-# from the tagged JASP sources on Arch by
-# https://gitea.weircon.dk/agw/jasp-desktop-bin and published to GitHub Releases.
+# PROVENANCE OF THE BINARY
+#
+# Upstream JASP publishes installers for Windows and macOS only; the official
+# Linux channel is Flathub. The binary this package installs is therefore NOT an
+# upstream release artifact. It is compiled from the tagged JASP sources
+# (@JASP_TAG@, commit @JASP_COMMIT@) on Arch Linux by an automated
+# pipeline, and
+# published to GitHub Releases:
+#
+#   build recipe:  https://gitea.weircon.dk/agw/jasp-desktop-bin
+#   release:       @DOWNLOAD_URL@
+#
+# It bundles its own R @BUNDLED_R@ and the non-system libraries it links against
+# under /opt/jasp-desktop, so it does not constrain the versions of anything on
+# your system. Built against Qt @QT_MINOR@.
 
 pkgname=jasp-desktop-bin
 pkgver=@JASP_VERSION@
diff --git a/scripts/gen-pkgbuild.py b/scripts/gen-pkgbuild.py
index 98786fe..255ad52 100755
--- a/scripts/gen-pkgbuild.py
+++ b/scripts/gen-pkgbuild.py
@@ -68,8 +68,11 @@ def main() -> int:
     substitutions = {
         "@MAINTAINER@": args.maintainer,
         "@JASP_VERSION@": jasp_version,
+        "@JASP_TAG@": info["jasp_tag"],
+        "@JASP_COMMIT@": info["jasp_commit"],
         "@PKGREL@": str(pkgrel),
         "@BUNDLED_R@": info["bundled_r_version"],
+        "@QT_MINOR@": qt_minor,
         "@DOWNLOAD_URL@": download_url,
         "@SHA256@": info["sha256"],
     }