diff --git a/.claude/skills/recipe-report/SKILL.md b/.claude/skills/recipe-report/SKILL.md
index 5247cce..cf3c1cf 100644
--- a/.claude/skills/recipe-report/SKILL.md
+++ b/.claude/skills/recipe-report/SKILL.md
@@ -48,7 +48,7 @@ keeps every weekly edition looking the same regardless of which model writes the
        lists **failed sources**, the count is **not** authoritative: render the cve cell as `?`
        (unknown), never `none` — a blank that reads as "clean" is exactly how two CVSS-9.8 gitea
        RCEs were reported as "none" on 2026-08-07.
-     - The table's **CVEs fixed** column counts known CVEs addressed by the available recipe upgrade.
+     - The table's **CVEs** column counts known CVEs addressed by the available recipe upgrade.
        A zero for an up-to-date recipe means there is no upgrade window to credit; it does not
        certify that the running images are free of vulnerabilities. If an upgrade exists but its
        advisory scan is absent, a source failed, or an image window was unmatched, use `?`.
diff --git a/cc-ci-plan/recipe-report.py b/cc-ci-plan/recipe-report.py
index beb0563..f114c04 100755
--- a/cc-ci-plan/recipe-report.py
+++ b/cc-ci-plan/recipe-report.py
@@ -217,8 +217,7 @@ def _table(rows, repo_url=None):
         return ""
     # TESTS = the CI/test verdict (GREEN/FAILED/STALE/…); STATUS = the PR's LIVE state, fetched
     # client-side (open vs ✓ for any not-open state) by the inline script in _page().
-    head = ("<tr><th>Recipe</th><th>Change</th><th>TESTS</th>"
-            '<th title="Known CVEs fixed by the available recipe upgrade; zero does not certify the current image as vulnerability-free">CVEs fixed</th>'
+    head = ("<tr><th>Recipe</th><th>Change</th><th>TESTS</th><th>CVEs</th>"
             "<th>CI</th><th>PR</th><th>STATUS</th><th>Notes</th></tr>")
     trs = []
     for r in rows: