diff --git a/.github/aw/cli-commands.md b/.github/aw/cli-commands.md
index 0e11edc2824..cc1b9ed3157 100644
--- a/.github/aw/cli-commands.md
+++ b/.github/aw/cli-commands.md
@@ -223,6 +223,7 @@ Update imported shared workflow components.
 ```bash
 gh aw update                                # Update all workflows from source
 gh aw update <workflow-name>                # Update a specific workflow
+gh aw update <package-url-or-name>          # Update all workflows installed from a package
 gh aw update --major                        # Allow major version updates
 gh aw update --create-pull-request          # Update and open a PR (alias: --pr)
 gh aw update --repo owner/repo              # Update workflows in another repository (isolated shallow checkout)
diff --git a/.github/aw/safe-outputs-runtime.md b/.github/aw/safe-outputs-runtime.md
index 446791269d1..4ee535d9778 100644
--- a/.github/aw/safe-outputs-runtime.md
+++ b/.github/aw/safe-outputs-runtime.md
@@ -184,6 +184,8 @@ The `report-incomplete` safe-output is enabled by default and is distinct from `
 - `footer:` - Global footer control for all safe outputs (boolean, default: `true`)
   - When `false`, omits visible AI-generated footer content from all created/updated entities (issues, PRs, discussions, releases) while still including XML markers for searchability
   - Individual safe-output types can override this setting
+- `body-footer:` - Deterministic template appended to every body-producing safe output, additive with any handler-specific `body-footer:` (string)
+  - Appended even when `footer: false` omits the AI-generated footer
 - `staged:` - Preview mode for all safe outputs (boolean)
   - When `true`, emits step summary messages instead of making GitHub API calls; useful for testing without side effects
 - `env:` - Environment variables passed to all safe output jobs (object)
diff --git a/.github/aw/safe-outputs.md b/.github/aw/safe-outputs.md
index 5b760d70976..0bdcc0c94eb 100644
--- a/.github/aw/safe-outputs.md
+++ b/.github/aw/safe-outputs.md
@@ -19,3 +19,4 @@ Safe outputs are the write path for agentic workflows. Keep the main agent job r
 - Always scope mutating operations as tightly as possible.
 - For pull-request or branch mutation, always restrict `allowed-files`.
 - Use `noop` when no visible change is required after successful execution.
+- `target:` is enforced, not merely validated: when set to `"triggering"` or a fixed number, any issue/PR number the agent supplies in its JSON output (including temporary-id references) is ignored in favor of the configured target. Only `target: "*"` lets the agent's own output select which issue/PR is affected.