diff --git a/20260607-2FA-email-mobile-auth-flow.md b/20260607-2FA-email-mobile-auth-flow.md
index 3920c76..3bee835 100644
--- a/20260607-2FA-email-mobile-auth-flow.md
+++ b/20260607-2FA-email-mobile-auth-flow.md
@@ -209,7 +209,7 @@ Outbound (BE PHP):
   From: Android Cast Issues <noreply@apps.f0xx.org>
   Reply-To: info@apps.f0xx.org
   SMTP: transactional relay (see §9.5)
-  Verify/reset links: always **`https://s.f0xx.org/…`** (url shortener) — never raw long URLs in email bodies
+  Verify/reset links: always **`https://s.f0xx.org/…`** in the email body; attach **QR PNG** encoding the same short link with **`?src=qr`** for phone scan analytics
 ```
 
 Document chosen provider in [`INFRA.md`](INFRA.md) § changelog once live.