diff --git a/.github/workflows/call-super-linter.yaml b/.github/workflows/call-super-linter.yaml
index 48ce14e..c349411 100644
--- a/.github/workflows/call-super-linter.yaml
+++ b/.github/workflows/call-super-linter.yaml
@@ -3,34 +3,55 @@
 name: Lint Code Base
 
 on:
-  
+  # run anytime a PR is merged to main or a direct push to main
   push:
     branches: [main]
-  
+
+  # run on any push to a PR branch
   pull_request:
 
+# cancel any previously-started, yet still active runs of this workflow on the same branch
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+# reset permissions to none at the workflow level
+# we'll set them at the job level below
+permissions: {}
+
 jobs:
   call-super-linter:
-
     name: Call Super-Linter
-    
+
     permissions:
-      contents: read # clone the repo to lint
-      statuses: write #read/write to repo custom statuses
+      contents: read # clone the repository to lint
+      pull-requests: write # create a summary comment in PR
+      statuses: write # read/write to repository custom statuses
 
     ### use Reusable Workflows to call my workflow remotely
     ### https://docs.github.com/en/actions/learn-github-actions/reusing-workflows
-    ### you can also call workflows from inside the same repo via file path
+    ### you can also call workflows from inside the same repository via file path
+
+    # FIXME: customize uri to point to your own reusable linter repository
+    # NOTE: zizmor scanner rule ignore added because we control sha pins via reusable workflow, not calling workflow
+    uses: bretfisher/super-linter-workflow/.github/workflows/reusable-super-linter.yaml@main # zizmor: ignore[unpinned-uses]
+
 
-    uses: bretfisher/super-linter-workflow/.github/workflows/reusable-super-linter.yaml@main
-    
     ### Optional settings examples
-    
+
     # with:
-      ### For a DevOps-focused repository. Prevents some code-language linters from running
-      ### defaults to false
-      # devops-only: false
-      
-      ### A regex to exclude files from linting
-      ### defaults to empty
-      # filter-regex-exclude: html/.*
+    ### 1. Remember .github/super-linter.env is injected for setting linter on/off
+
+    ### 2. For a DevOps-focused repository. Prevents some code-language linters from running
+    ### defaults to false
+    # devops-only: false
+
+    ### 3. A regex to exclude files from linting
+    ### defaults to empty
+    # filter-regex-exclude: html/.*
+    #
+    ### 4. Additional environment variables to pass to super-linter (one per line)
+    # extra-envs: |
+    #   VALIDATE_DOCKERFILE=false
+    #   VALIDATE_JSCPD=false
+    #   VALIDATE_TRIVY=false