diff --git a/README.md b/README.md
index 1ee3ac3..d58f149 100644
--- a/README.md
+++ b/README.md
@@ -58,3 +58,6 @@ to Vault via kubernetes auth (`terraform-enc` ServiceAccount). Locally:
 make plan    # approle auth by default (needs env with VAULT_ROLEID)
 make apply
 ```
+
+The plan pipeline doubles as a live conformance check of the encapi API: a
+no-op plan proves the deployed encapi still serves reads correctly.