diff --git a/example-workflows/cloud-run/README.md b/example-workflows/cloud-run/README.md
index e22a3df7..34cdcdb5 100644
--- a/example-workflows/cloud-run/README.md
+++ b/example-workflows/cloud-run/README.md
@@ -40,11 +40,13 @@ For pushes to the _default_ branch, `master`, the workflow will:
 
 1. [Add the the following role to your service account][roles]:
 
-  * `Cloud Run Admin`
-  * `Cloud Build Editor`
-  * `Viewer`
+  * `Cloud Run Admin - roles/run.admin`: allows for the creation of new services
+  * `Viewer - roles/viewer`: allows for viewing the project (needed for Storage access)
+  * `Cloud Build Service Account - roles/cloudbuild.builds.builder`: allows for
+    running and manipulating Cloud Build and Storage resources
+  * `Service Account User - roles/iam.serviceAccountUser`: actAs requirement
 
-1. Enable the [Cloud Run API and Cloud Build API.](https://console.cloud.google.com/flows/enableapi?apiid=cloudbuild.googleapis.com,run.googleapis.com&redirect=https://console.cloud.google.com&_ga=2.248833607.-1346582427.1578963531). 
+1. Enable the [Cloud Run API and Cloud Build API.](https://console.cloud.google.com/flows/enableapi?apiid=cloudbuild.googleapis.com,run.googleapis.com&redirect=https://console.cloud.google.com&_ga=2.248833607.-1346582427.1578963531).
 
 ## Run the workflow
 
@@ -62,6 +64,10 @@ git push origin master
 1. View the workflow by selecting the `Actions` tab at the top of your repository.
 Then click on the `Build and Deploy to Cloud Run` workflow to see the details.
 
+**Note**: If this is your first Cloud Run deployment, your image will not allow
+unauthenticated requests. If this is a service revision, then your service will
+persist the current setting. Learn more about [allowing public access](https://cloud.google.com/run/docs/authenticating/public).
+
 [secrets]: https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets
 [cluster]: https://cloud.google.com/kubernetes-engine/docs/quickstart#create_cluster
 [roles]: https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource
diff --git a/example-workflows/cloud-run/cloud-run.yml b/example-workflows/cloud-run/cloud-run.yml
index cc1d143d..9f316e2f 100644
--- a/example-workflows/cloud-run/cloud-run.yml
+++ b/example-workflows/cloud-run/cloud-run.yml
@@ -57,5 +57,4 @@ jobs:
         run: |
           gcloud run deploy $SERVICE_NAME \
             --image gcr.io/$PROJECT_ID/$SERVICE_NAME:$GITHUB_SHA \
-            --platform managed \
-            --allow-unauthenticated
+            --platform managed