diff --git a/.wordlist.txt b/.wordlist.txt
index 144571a5..9a9229e2 100644
--- a/.wordlist.txt
+++ b/.wordlist.txt
@@ -91,6 +91,9 @@ auth
 authed
 authing
 bytecode
+Calc
+CalcFab
+calldata
 casted
 checksummed
 codehash
@@ -135,6 +138,11 @@ precomputed
 prepended
 redemptions
 repos
+RPC
+RWA
+RWAXXX
+RWAXYZ
+safeharbor
 setIlkAutoLineDebtCeiling
 setIlkAutoLineParameters
 setIlkDebtCeiling
diff --git a/spell/spell-crafter-mainnet-workflow.md b/spell/spell-crafter-mainnet-workflow.md
index 60aba93e..59c31967 100644
--- a/spell/spell-crafter-mainnet-workflow.md
+++ b/spell/spell-crafter-mainnet-workflow.md
@@ -65,6 +65,8 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
   * Ensure correctness of the cleanup
     * [ ] Run Tests `make test` (or `make test match=<test_name>` to inspect debug traces)
   * [ ] Commit the cleanup (e.g. `git commit -am "Base spell"`)
+* [ ] Run `make safeharbor-generate` to ensure that updates match the bug bounty updates instructions on the Exec Sheet
+  * [ ] IF there is a mismatch, notify Governance Facilitators
 * Add comments to the spell based on the relevant [Exec Sheet](https://docs.google.com/spreadsheets/d/1w_z5WpqxzwreCcaveB2Ye1PP5B8QAHDglzyxKHG3CHw)
   * [ ] Copy every _Section text_ from the Exec Sheet as comment to the spell code
   * [ ] Surround the comment by the set of dashes (e.g. `// ----- Section text -----`)
@@ -126,6 +128,15 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
     * [ ] Removals are tested via `testRemovedChainlogKeys`
   * [ ] Adjust system values, collateral values inside `config.sol`
   * [ ] Ensure every spell variable is declared as public/internal
+  * Bug Bounty Registry Updates
+    * [ ] Check that output of `make safeharbor-generate` matches the instructions provided by Governance Facilitators
+      * [ ] IF no instructions were provided and script produces "no changes", then no further action is required
+      * [ ] IF there is a mismatch, crafter should notify Governance Facilitators
+      * [ ] IF the scripts outputs a warning indicated by ⚠️ ❗, notify Governance Facilitators
+      * [ ] IF the command outputs a solidity snippet that matches the instructions provided by Governance Facilitators:
+        * [ ] Paste the generated code into the spell as is. The code should not be modified. You may adjust formatting
+        * [ ] Fetch the agreement address from the `ChainLog`
+        * [ ] IF not already present, add the helper function to perform the call, using the established archive pattern
   * IF Prime Agent spell is provided
     * [ ] Handover message matches `XXX spell YYYY-MM-DD deployed to 0x… with hash 0x…, direct execution: yes / no` template
     * [ ] IF `direct execution` is `no`
@@ -147,6 +158,8 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
     * [ ] Sanity checks of the constructor arguments
     * [ ] Sanity checks of all values added/updated by the spell function
     * [ ] End-to-end "happy path" interaction with the module
+  * IF bug bounty updates are present
+    * [ ] Test that all bug bounty registry calls execute successfully
   * [ ] Tests PASS via `make test`
 * [ ] Ensure `DssExecLib` address used in current spell (`DssExecLib.address`) matches `dss-exec-lib` [Latest Release Tag](https://github.com/sky-ecosystem/dss-exec-lib/releases/latest)
 * [ ] Push committed content to already opened PR
@@ -225,6 +238,7 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
   * [ ] Create testnet and cast deployed spell there using `make cast-on-tenderly spell=0x...` command
   * [ ] Check that returned `public explorer url` is publicly accessible (e.g. using incognito browser mode)
   * [ ] IF `cast-on-tenderly` command is executed several times for the same spell, delete all testnets of the same name except the last one
+* [ ] `make safeharbor-generate` returns "no updates" in the testnet environment after spell was cast
 * [ ] Archive Spell via `make archive-spell` for the current date (or `make archive-spell date="YYYY-MM-DD"`) using Target Date inside the Exec Doc
 * [ ] Commit & push changes for review
 * [ ] Wait for CI to PASS
diff --git a/spell/spell-reviewer-mainnet-checklist.md b/spell/spell-reviewer-mainnet-checklist.md
index 28d2e787..cd7e5b1c 100644
--- a/spell/spell-reviewer-mainnet-checklist.md
+++ b/spell/spell-reviewer-mainnet-checklist.md
@@ -19,6 +19,8 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
   * [ ] Office hours is `true` IF spell introduces a major change that can affect external parties (e.g.: keepers are affected in case of collateral offboarding) OTHERWISE explicitly set to `false`
   * [ ] Office hours value matches the Exec Sheet
   * [ ] 30 days spell expiry set in the constructor (`block.timestamp + 30 days`)
+* [ ] `make safeharbor-generate` output matches the instructions on the Exec Sheet
+  * [ ] IF there is a mismatch, notify Governance Facilitators
 * Spell description
   * [ ] Description follows the format `TARGET_DATE MakerDAO Executive Spell | Hash: EXEC_DOC_HASH`
   * [ ] `TARGET_DATE` in the description matches the target date
@@ -288,6 +290,13 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
   * [ ] Target contract is not upgradable
   * [ ] Target Contract is included in the ChainLog
   * [ ] Test Coverage is comprehensive
+* IF bug bounty registry updates are present
+  * [ ] Run `make safeharbor-generate`
+    * [ ] Verify that the generated code exactly matches the code in the spell
+    * [ ] Verify that output matches the instructions provided by Governance Facilitators
+    * [ ] Ensure that the script does not output any warnings, which are indicated by ⚠️ ❗
+  * [ ] Ensure that agreement address is fetched from the Chainlog
+  * [ ] Ensure that the helper function to perform the call is present and is implemented using the established archive pattern
 * IF spell interacts with ChainLog
   * [ ] ChainLog version is incremented based on update type
     * Major -> New Vat (++.0.0)
@@ -401,6 +410,8 @@ _Insert your local test logs here_
   * [ ] All actions are executed in the transaction trace
   * [ ] No reverts are present that block execution
   * [ ] No out-of-gas errors are present
+  * [ ] `make safeharbor-generate` against the testnet returns "no updates"
+    * [ ] IF the script outputs a warning indicated by ⚠️ ❗, notify Governance Facilitators
 * Archive checks
   * [ ] `make diff-archive-spell` for current date or `make diff-archive-spell date="YYYY-MM-DD"`
   * [ ] Ensure date corresponds to target Exec Doc date