diff --git a/src/artifacts/ReleaseExposureReader.test.ts b/src/artifacts/ReleaseExposureReader.test.ts
index bc25604faf..8c795c4016 100644
--- a/src/artifacts/ReleaseExposureReader.test.ts
+++ b/src/artifacts/ReleaseExposureReader.test.ts
@@ -1352,6 +1352,10 @@ describe("ReleaseExposureReader source spellings", () => {
     expect(scanned.source_maps.embedded).toBe(0);
     expect(scanned.coverage).toBe("unknown");
     expect(sourceMapSourcesStatus(scanned)).toBe("unknown");
+    expect(scanned.extractable.readable_members).toBe(1);
+    expect(scanned.extractable.samples).toEqual([
+      expect.stringContaining("inner.asar"),
+    ]);
   });
 
   it("reopens a decomposed compressed .NET member", async () => {
diff --git a/src/artifacts/ReleaseExposureReader.ts b/src/artifacts/ReleaseExposureReader.ts
index 1c5c2f709b..2eea22dd82 100644
--- a/src/artifacts/ReleaseExposureReader.ts
+++ b/src/artifacts/ReleaseExposureReader.ts
@@ -482,13 +482,19 @@ const scanOccurrences = async (
       continue;
     }
     // A nested package that inventory recognized but did not expand was
-    // never assessed, so its members leave coverage unknown.
+    // never assessed, so its members leave coverage unknown. The nested
+    // package itself is still an unencrypted member of its parent that
+    // inventory already read, so it counts as a readable payload.
     if (
       packageKind !== null &&
       !parentsWithChildren.has(occurrence.occurrence_id)
     ) {
       state.formats.add(packageKind);
       noteUnexaminedPackage(state);
+      if (!occurrence.encrypted) {
+        state.readable += 1;
+        pushSample(state.memberSamples, location);
+      }
       pushLimitation(state, `Nested package ${location} was not expanded.`);
       continue;
     }