diff --git a/pkg/cli/data/agentic_workflows_fallback_aw_files.json b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
index b1f63d9fc3c..7d1f03c07d6 100644
--- a/pkg/cli/data/agentic_workflows_fallback_aw_files.json
+++ b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
@@ -15,6 +15,7 @@
   "debug-agentic-workflow.md",
   "dependabot.md",
   "deployment-status.md",
+  "designer-mappings.md",
   "designer.md",
   "evals.md",
   "experiments.md",
diff --git a/pkg/workflow/js/exchange_otlp_workload_identity.cjs b/pkg/workflow/js/exchange_otlp_workload_identity.cjs
index 49fbc63a218..4502bc65a22 100644
--- a/pkg/workflow/js/exchange_otlp_workload_identity.cjs
+++ b/pkg/workflow/js/exchange_otlp_workload_identity.cjs
@@ -1,4 +1,5 @@
 // @ts-check
+// @safe-outputs-exempt SEC-004 — "body" references are HTTP transport payloads for OAuth token exchange, not GitHub content
 /**
  * Exchanges a GitHub OIDC token for a Google Cloud access token using
  * Workload Identity Federation, optionally impersonating a service account.