diff --git a/doc/guides/security-release-process.md b/doc/guides/security-release-process.md
index 42e34b4dd82548..a0986a5c04a889 100644
--- a/doc/guides/security-release-process.md
+++ b/doc/guides/security-release-process.md
@@ -43,7 +43,6 @@ information described.
   * Described in the pre/post announcements
 
 * [ ] Pre-release announcement [email][]: ***LINK TO EMAIL***
-   * CC: `oss-security@lists.openwall.com`
    * Subject: `Node.js security updates for all active release lines, Month Year`
    * Body:
   ```text
@@ -52,6 +51,12 @@ information described.
   ```
   (Get access from existing manager: Ben Noordhuis, Rod Vagg, Michael Dawson)
 
+* [ ] CC `oss-security@lists.openwall.com` on pre-release
+
+The google groups UI does not support adding a CC, until we figure
+out a better way, forward the email you receive to
+`oss-security@lists.openwall.com` as a CC.
+
 * [ ] Pre-release announcement to nodejs.org blog: ***LINK TO BLOG***
   (Re-PR the pre-approved branch from nodejs-private/nodejs.org-private to
   nodejs/nodejs.org)