diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index 1972d81..72c78f9 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -19,6 +19,12 @@ If any one maintainer becomes unavailable, for any reason, the others hold the a
 keep the project running: each can create and close issues, accept proposed changes, and publish a
 release. Nothing in the ordinary workflow requires a specific individual.
 
+Access is not given informally. Every account with write access to the repository must have
+two-factor authentication enabled, and the organisation enforces that rather than asking for it:
+an account without it loses access instead of being reminded. This is a requirement on the people
+who can change what this project ships, and it is stated here because a project whose maintainers
+can be phished has no supply chain integrity regardless of what the rest of this document says.
+
 The exceptions are named here rather than left to be discovered. Administration of the GitHub
 organisation, the domain, and the security mailbox rest with the author. Restoring those to a
 surviving maintainer is a legal and administrative matter, not a technical one, and it is the first
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index 18bf150..05452cb 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -9,9 +9,9 @@
 
 Three maintainers as of 2026-09-23, up from one. Any of them can accept a proposed change, close
 an issue and cut a release; administration of the GitHub organisation rests with the author.
-Repository access for @mikehostetler was granted on 2026-09-23 and is pending acceptance at the
-time of writing, which is recorded rather than glossed because a maintainers file is the sort of
-document people check against the repository itself.
+
+**Two-factor authentication is required** for everyone with write access to this repository,
+enforced by the organisation rather than asked for in a document.
 
 That asymmetry is written down rather than smoothed over, because "three maintainers" and "three
 people who can do everything" are different claims and only the first is true. `GOVERNANCE.md`