From dbd159be7087f3e5585a54f5c83fe92603f52c11 Mon Sep 17 00:00:00 2001
From: "Timothy J. Aveni" <tja@berkeley.edu>
Date: Wed, 7 Oct 2026 16:52:20 -0700
Subject: [PATCH] Keep checked browser runtime versions independent of
 authority upgrades

---
 restricted-execution/workerd.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/restricted-execution/workerd.nix b/restricted-execution/workerd.nix
index 087b9ef..35a1014 100644
--- a/restricted-execution/workerd.nix
+++ b/restricted-execution/workerd.nix
@@ -1,5 +1,6 @@
 # Pinned upstream engine. This binary supplies an import/capability boundary;
-# production execution additionally requires a workspace VM and OS limits.
+# production execution additionally requires OS limits and platform approval
+# for shared placement, or a workspace VM for unreviewed application code.
 { pkgs }:
 let
   version = "1.20261005.1";
@@ -37,7 +38,7 @@ pkgs.stdenvNoCC.mkDerivation {
     "$out/bin/workerd" --version | grep -Fx 'workerd 2026-10-05'
   '';
   meta = {
-    description = "Pinned workerd engine for VM-scoped Quixos restricted execution";
+    description = "Pinned workerd engine for Quixos restricted execution";
     homepage = "https://github.com/cloudflare/workerd";
     license = pkgs.lib.licenses.asl20;
     platforms = builtins.attrNames platforms;