diff --git a/specs/unified_kernel_image.md b/specs/unified_kernel_image.md
index 06551d5e..3ef5edaa 100644
--- a/specs/unified_kernel_image.md
+++ b/specs/unified_kernel_image.md
@@ -47,6 +47,10 @@ header to 0x0A (i.e. `IMAGE_SUBSYSTEM_EFI_APPLICATION`).
 ## UKI Components
 UKIs consist of the following resources:
 
+<!--
+NOTE: these components are in canonical order for predictable PCR measurements.
+Please add any new components at the bottom of the list and NEVER reorder anything in this list.
+-->
 * An UEFI boot stub that forms the initial program.
   It contains various PE sections normally required for a program,
   including `.text`, `.reloc`, `.data`, and others.