diff --git a/README.md b/README.md
index d65b4df..64e6b60 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,9 @@ In order to make code changes to WP-CLI, you'll need to set up this `wp-cli-dev`
 2. Install all Composer dependencies for a complete `wp-cli-bundle` setup, while symlinking all of the previously cloned packages into the Composer `vendor` folder.
 3. Symlink all folder in `vendor` into corresponding `vendor` folders in each repository, thus making the centralized functionality based on Composer available in each repository subfolder.
 
-Before you can proceed further, you'll need to make sure you have [Composer](https://getcomposer.org/), PHP, and a functioning MySQL or MariaDB server on your local machine.
+Before you can proceed further, you'll need to make sure you have [Composer](https://getcomposer.org/) 2.9 or later, PHP, and a functioning MySQL or MariaDB server on your local machine.
+
+Composer 2.9 and later refuse to install package versions with known security advisories, which protects the development environment from vulnerable dependencies. That is why WP-CLI doesn't rely on the `roave/security-advisories` package for this anymore. Older Composer versions install without this check. See the [Composer 2.9 release post](https://blog.packagist.com/composer-2-9/) for details.
 
 Once the prerequisites are met, clone the GitHub repository and run the installation process: