diff --git a/PHPGuard/VulnerabilityService.swift b/PHPGuard/VulnerabilityService.swift
index 3a0f4f3..7a143ab 100644
--- a/PHPGuard/VulnerabilityService.swift
+++ b/PHPGuard/VulnerabilityService.swift
@@ -397,9 +397,28 @@ extension VulnerabilityService {
             return assessments.map { original in
                 var item = original
                 item.vendorStatus = "Unverified"
-                item.vendorEvidence =
-                    "Ubuntu archive provenance not established for installed PHP packages. " +
-                    "Third-party or custom builds require independent verification."
+                let ubuntuMatches = report.packageOrigins.filter {
+                    $0.hasPrefix("UBUNTU_REPOSITORY_MATCH|")
+                }
+
+                let otherMatches = report.packageOrigins.filter {
+                    $0.hasPrefix("OTHER_REPOSITORY_MATCH|")
+                }
+
+                if !ubuntuMatches.isEmpty && otherMatches.isEmpty {
+                    item.vendorEvidence =
+                        "Installed PHP package versions match official Ubuntu repository entries. " +
+                        "Installed binary provenance has not been independently verified; " +
+                        "vendor CVE status remains Unverified."
+                } else if !otherMatches.isEmpty {
+                    item.vendorEvidence =
+                        "One or more PHP package versions match third-party repositories. " +
+                        "Ubuntu vendor CVE status remains Unverified."
+                } else {
+                    item.vendorEvidence =
+                        "Ubuntu archive provenance not established for installed PHP packages. " +
+                        "No confirmed Ubuntu repository matches were collected."
+                }
                 return item
             }
         }