diff --git a/app/utils/ocr_provider.py b/app/utils/ocr_provider.py
index 2167d9b8..79977e7a 100644
--- a/app/utils/ocr_provider.py
+++ b/app/utils/ocr_provider.py
@@ -115,6 +115,9 @@ def embed_text_layer(input_pdf_path: str, output_pdf_path: str, *, language: str
 
     logger.info(f"[embed_text_layer] Running: {' '.join(cmd)}")
 
+    # Security note: shell=False (the default) is used so no shell interpolation occurs.
+    # ocrmypdf_bin is resolved via shutil.which() (trusted system PATH).
+    # input_pdf_path / final_output are internal workdir paths, not raw user input.
     try:
         proc = subprocess.run(cmd, capture_output=True, text=True, timeout=600, check=False)  # noqa: S603
     except subprocess.TimeoutExpired:
diff --git a/tests/test_ocr_processing.py b/tests/test_ocr_processing.py
index e17697bc..3329613f 100644
--- a/tests/test_ocr_processing.py
+++ b/tests/test_ocr_processing.py
@@ -1131,7 +1131,7 @@ class TestEmbedTextLayer:
         mock_proc.returncode = 0
         mock_proc.stderr = ""
 
-        def fake_run(cmd, **kwargs):  # noqa: ANN001
+        def fake_run(cmd: list[str], **kwargs: object) -> Mock:
             # Simulate ocrmypdf writing to the temp output path.
             out_path = cmd[-1]
             with open(out_path, "wb") as fh:
@@ -1162,7 +1162,7 @@ class TestEmbedTextLayer:
 
         real_mkstemp = __import__("tempfile").mkstemp
 
-        def fake_mkstemp(**kwargs):  # noqa: ANN001
+        def fake_mkstemp(**kwargs: object) -> tuple[int, str]:
             fd, path = real_mkstemp(**kwargs)
             created_tmp.append(path)
             # Write something so the cleanup code can find the file.