diff --git a/.github/workflows/bdba.yaml b/.github/workflows/bdba.yaml
index 2eca5b6..ba4a765 100644
--- a/.github/workflows/bdba.yaml
+++ b/.github/workflows/bdba.yaml
@@ -1,5 +1,10 @@
 # Workflow to upload CTFs to Black Duck Binary Analysis (BDBA) for scanning.
 # Located in .github repo to be shared across all repositories in the GH org.
+# This workflow is triggered by other workflows, e.g., release workflow.
+# The secret for the BDBA_API_TOKEN is generated in another workflow
+# (https://github.com/open-component-model/.github/actions/workflows/rotate-bdba-token.yml)
+# which is scheduled to run every 30 days. By policy the maximum lifetime of a token is 180 days.
+
 name: BDBA Scan
 
 on:
diff --git a/.github/workflows/rotate-bdba-token.yml b/.github/workflows/rotate-bdba-token.yml
index 553210b..57d51d4 100644
--- a/.github/workflows/rotate-bdba-token.yml
+++ b/.github/workflows/rotate-bdba-token.yml
@@ -1,5 +1,8 @@
-# Rotate Black Duck Binary Analysis API token on a monthly basis
+# Rotate Black Duck Binary Analysis API token on a monthly basis.
+# Per SAP policy the maximum lifetime of a BDBA token is 180 days.
 # The token is used in the worklfow bdba.yaml and stored as a secret on org level
+# The secret is used in the BDBA workflows.
+
 name: BDBA Token Rotation
 
 permissions: