Industrial boilers are heavy-duty furnaces used to generate steam and other useful heat for a wide range of applications, such as milling paper and manufacturing car parts. These boilers reach and sustain extremely high temperatures, relying on varying combinations of fuels and combustion techniques to do so. But all share a common environmental risk: Without adequate controls in place, they send into the air large quantities of toxic pollutants that endanger public health.

To mitigate such dangers, the Environmental Protection Agency (EPA or Agency) issued rules under the Clean Air Act to govern emissions of those pollutants. See Final Rule on Reconsideration, National Emission Standards for Hazardous Air Pollutants for Major Sources: Industrial, Commercial, and Institutional Boilers and Process Heaters , 78 Fed. Reg. 7138 , 7144 (Jan. 31, 2013). A slew of legal challenges followed. We have already considered and resolved most of them in United States Sugar Corp. v. EPA ( U.S. Sugar ), 830 F.3d 579 (D.C. Cir. 2016). But because EPA granted petitions for reconsideration on two issues, we agreed to sever those issues from U.S. Sugar . Upon additional consideration, EPA made some changes to its rules. Several environmental groups, which we refer to collectively as Sierra Club, challenge the reconsidered rules, and we now take up their petitions. 1 See Final Rule on Reconsideration II, *1189 National Emission Standards for Hazardous Air Pollutants for Major Sources: Industrial, Commercial, and Institutional Boilers and Process Heaters , 80 Fed. Reg. 72,790 (Nov. 20, 2015).

The first challenge concerns EPA regulations that indirectly control a group of organic pollutants by limiting carbon monoxide emissions as a proxy for the targeted pollutants. After calculating emissions limits for the organic pollutants by reference to the amount of carbon monoxide emitted by the best performing boilers in each subcategory, EPA concluded that the lowest of the carbon monoxide limits were too low, so it substituted a single, higher limit that it deemed sufficient to control the pollutants. Sierra Club contends that the EPA's about-face was unjustified and contrary to the Clean Air Act.

The second challenge concerns rules governing how boilers operate while starting up and shutting down. Given the high temperatures involved, startup and shutdown can take hours, during which conditions inside a boiler are in flux. EPA found it infeasible to set numeric limits on pollutants during startup and shutdown, so instead set qualitative "work practice" standards. Sierra Club contends that those work practice standards give boiler operators unlawful leeway to pollute.

For the reasons that follow, we conclude that Sierra Club is right on the first score but wrong on the second. EPA did not adequately justify its change of direction on the carbon monoxide limits because it failed to explain how the revised limits would minimize the targeted pollutants to the extent the Clean Air Act requires. But its startup and shutdown work practice standards are permissible because, consistent with the Clean Air Act, they reasonably approximate what the best-performing boilers can achieve.

I.

As amended in 1990, the Clean Air Act (Act) specifies a list of nearly two hundred hazardous air pollutants (HAPs) for which the EPA must set national emissions standards. See 42 U.S.C. § 7412 (b), (d) ; U.S. Sugar , 830 F.3d at 593 . EPA is first required to categorize and, where appropriate, sub-categorize potential sources of each HAP. See 42 U.S.C. § 7412 (c), (d). The Agency must categorize polluters by volume of emissions. Id. § 7412(c). The most voluminous polluters, dubbed "major sources," id. § 7412(a)(1), must be regulated with particular care, see id. § 7412(d)(1). The Agency must also distinguish between new sources and existing ones. U.S. Sugar , 830 F.3d at 593-94 (citing 42 U.S.C. § 7412 (d)(3) ). EPA also may further "differentiate 'among classes, types, and sizes of sources.' " Id. (quoting 42 U.S.C. § 7412 (d)(1) ).

Here, the relevant category is major-source industrial, commercial, and institutional boilers and process heaters-which EPA refers to, for short, as industrial boilers. This category runs the gamut of heavy-duty boilers used by industries and large institutions, but excludes similar, separately regulated equipment that burns solid waste or generates electricity. See Proposed Rule, National Emission Standards for Hazardous Air Pollutants for Major Sources:Industrial, Commercial, and Institutional Boilers and Process Heaters , 75 Fed. Reg. 32,006 , 32,009, 32,016 (June 4, 2010). A single set of rules governs the industrial boilers at issue here during startup and shutdown. See 80 Fed. Reg. at 72,824 . Because EPA identified "significant design and operational differences" among these industrial boilers based on their primary fuels and (for certain HAPs) the combustion technology used to burn those fuels, however, EPA imposed separate operating-state emissions limits on subcategories identified by those criteria. Id. at 32 ,017 ; see also 78 Fed. Reg. at 7144 .

*1190 After categorizing sources, EPA prescribes standards for sources in each category or subcategory. The basic approach is technology-forcing: For major sources like those at issue here, EPA must identify the "maximum degree of reduction in emissions" that is "achievable" using current technology. 42 U.S.C. § 7412 (d)(2). It must then use that maximum achievable degree of reduction as an emissions cap for all similar sources. See U.S. Sugar , 830 F.3d at 594 ; Mexichem Specialty Resins, Inc. v. EPA , 787 F.3d 544 , 549-50 (D.C. Cir. 2015).

Congress prescribed how EPA must define those "maximum achievable control technology" (MACT) standards. EPA must at least set a so-called "MACT Floor" with respect to each pollutant-the minimum that sources must do to control emissions of the pollutant. 42 U.S.C. § 7412 (d)(3) ; see U.S. Sugar , 830 F.3d at 594 . The "floor" terminology can be confusing, because MACT Floors-baseline emissions standards-are upper limits, or caps, on emissions. MACT Floors allow emission of each pollutant only up to the level achieved either by the "best controlled similar source" in the relevant subcategory (for new sources), or by the lowest-emitting twelve percent of sources (for existing sources). 42 U.S.C. § 7412 (d)(3) ; see U.S. Sugar , 830 F.3d at 594 .

EPA may be required to set a "beyond-the-floor" standard as well-a more-stringent-still emissions cap calling on sources to perform even better than the current best performers. See U.S. Sugar , 830 F.3d at 594-95 . EPA must set a beyond-the-floor standard if it determines that additional emissions reduction would be achievable "taking into account costs, certain health and environmental effects, and energy requirements." Nat'l Ass'n for Surface Finishing v. EPA , 795 F.3d 1 , 4-5 (D.C. Cir. 2015) ; see 42 U.S.C. § 7412 (d)(2). Ordinarily, MACT Floors and beyond-the-floor standards that EPA crafts must apply "continuously" whenever sources are at risk of emitting pollutants-even when the sources are operating outside of normal parameters because they are starting up, shutting down, or malfunctioning. See Sierra Club v. EPA , 551 F.3d 1019 , 1027-28 (D.C. Cir. 2008).

The Act gives EPA certain kinds of carefully circumscribed flexibility, two of which figure centrally in this case. First, EPA may sometimes regulate a HAP indirectly, by controlling a proxy, or "surrogate," instead of the pollutant itself. See Sierra Club v. EPA , 863 F.3d 834 , 838 (D.C. Cir. 2017). The Act nowhere expressly contemplates regulation by surrogate, but we have held it permissible in some circumstances, so long as the resulting rules are reasonably calculated to control the relevant HAPs to the extent the statute demands. See U.S. Sugar , 830 F.3d at 628-29 . Second, EPA may sometimes set qualitative "work practice" standards, requiring sources to use certain protocols designed to minimize emissions in lieu of numeric limits measuring pollutants actually emitted. See 42 U.S.C. § 7412 (h). Work practice standards can be thought of as a statutory Plan B; EPA may resort to them only when using numeric limits is "not feasible." Id . § 7412(h)(1). The statute defines when EPA may conclude that numeric limits are infeasible, including-as relevant here-when "the application of measurement methodology to a particular class of sources is not practicable due to technological or economic limitations." Id. § 7412(h)(2)(B). When EPA sets work practice standards, those standards must be, in EPA's judgment, "consistent with" the Act's MACT requirements. Id. § 7412(h)(1) ; see U.S. Sugar , 830 F.3d at 663 .

The 1990 amendments to the Act called on EPA to promulgate national standards *1191 for every source category by the year 2000. See 42 U.S.C. § 7412 (e)(1)(E). That deadline has long since passed, and-after an earlier iteration of this rule was vacated in its entirety and rewritten, see Nat. Res. Def. Council v. EPA , 489 F.3d 1250 , 1261-62 (D.C. Cir. 2007) -these revised standards are among the last to be finalized. See Leslie Sue Ritts & Ben Snowden, The Regulation of Hazardous Air Pollutants , in Clean Air Act Handbook 249, 265-67 (Julie R. Domike & Alec C. Zacaroli, eds., 4th ed. 2016). For current purposes, we can pick up the tale with EPA's 2011 iteration of these rules. See Final Rule, National Emission Standards for Hazardous Air Pollutants for Major Sources: Industrial, Commercial, and Institutional Boilers and Process Heaters , 76 Fed. Reg. 15,608 (Mar. 21, 2011). Once it promulgated the 2011 version, EPA chose to reconsider that entire set of regulations almost immediately, re-finalized them in 2013 with significant changes, see 78 Fed. Reg. at 7138 ; Proposed Rule on Reconsideration, National Emission Standards for Hazardous Air Pollutants for Major Sources: Industrial, Commercial, and Institutional Boilers and Process Heaters , 76 Fed. Reg. 80,598 (Dec. 23, 2011), then further amended and reissued them as the 2015 final rule at issue here, 80 Fed. Reg. 72,790 .

Regulated industries and environmental groups mounted various legal challenges to the 2013 final rule, most of which we have already adjudicated. See generally U.S. Sugar , 830 F.3d 579 . But, between 2011 and 2013, EPA had so significantly changed certain aspects of the rule, including the two challenged here, that EPA decided to allow more time for public comment and to reconsider them yet again. See Proposed Rule on Reconsideration II, National Emission Standards for Hazardous Air Pollutants for Major Sources: Industrial, Commercial, and Institutional Boilers and Process Heaters , 80 Fed. Reg. 3090 (Jan. 21, 2015). Accordingly, at EPA's request, we severed challenges to these two aspects of the 2013 final rule from the U.S. Sugar proceedings and held them in abeyance pending the Agency's reconsideration. See Order, U.S. Sugar , No. 11-1108 (Oct. 16, 2013). The Agency's reconsideration of these aspects of the rules is now complete, and Sierra Club's remaining two challenges are now before us.

The first challenge targets certain limits on carbon monoxide (CO), which EPA controls as a surrogate for a group of listed pollutants known as "organic HAPs" (a term which, as used in this opinion, excludes dioxin and furan, two organic HAPs that EPA decided to regulate directly). Unlike organic HAPs, CO is not among the pollutants that EPA regulates under Section 7412, see 42 U.S.C. § 7412 (b) ; CO is regulated under a different part of the Act, see Util. Air Regulatory Grp. v. EPA , --- U.S. ----, 134 S.Ct. 2427 , 2435, 189 L.Ed.2d 372 (2014). In the 2011 rulemaking, EPA determined as a factual matter, supported by its analysis of the chemistry of combustion, that "minimizing CO emissions will result in minimizing ... organic HAP." 75 Fed. Reg. at 32,018 . It therefore identified CO as an effective proxy for those HAPs. Id . Then, using the data it had on boilers' CO emissions, EPA crunched the numbers to set a MACT Floor for CO as it normally would for a HAP. See id. at 32 ,019 -23, 32,027-29.

The best achievable results varied widely by boiler subcategory: For example, had EPA set MACT Floors according to those results, new "[s]tokers designed to burn pulverized coal/solid fossil fuel" would have been required to emit no more than 6 parts per million (ppm) CO, while new "[h]ybrid suspension/grate units designed to burn biomass/bio-based solids" would have been permitted to emit up to 1,500 ppm. 76 Fed. Reg. 15,687 . But when reconsidering the 2011 rule, EPA decided in the *1192 2013 rule to scrap the lowermost of its CO floors-those for which the calculated CO limit came in below 130 ppm. See 78 Fed. Reg. at 7144-45 . While EPA's data confirmed a close correlation between reduced CO emissions and reduced emissions of formaldehyde (a prevalent organic HAP) down to roughly that level, the same data puzzlingly appeared to show, not further reduction, but a spike in formaldehyde emissions at even lower CO levels. Id. at 7145 . In EPA's view, the data were therefore "not ... sufficiently reliable to use as a basis for establishing an emissions limit" lower than 130 ppm. Id . EPA declined to require any boiler to drive CO emissions lower, revising MACT Floor standards for several boiler subcategories upward to a new 130 ppm "threshold." Id . On further reconsideration in 2015, EPA stood by that upward-revised limit. 80 Fed. Reg. at 3096.

The second challenge targets EPA's "work practice" standards that govern boilers during startup and shutdown. Because conditions inside a boiler are in flux while heating up and cooling down, EPA determined that it would not be "feasible" to apply numeric emissions-testing methodologies, which are generally calibrated to steady-state operations. See 76 Fed. Reg. at 15,642 ; 2015 Response to Reconsideration Comments at II-3 (Oct. 2015) (Response to Comments), Joint App'x (J.A.) 351. But it also proved hard to identify what work practices EPA might feasibly require of boilers during startup and shutdown, and at what point in the process boilers could be treated as fully on line and thus meaningfully subject to numeric emissions limits. After the 2013 final rule, EPA reconsidered the startup and shutdown provisions a second time and made several significant refinements. See 80 Fed. Reg. at 3093-96. Those provisions, too, were finalized in 2015. See 80 Fed. Reg. 72,790 . Now that Sierra Club has timely petitioned for review of that final rule, both aspects are ready for our consideration.

II.

We first consider whether EPA acted arbitrarily and capriciously or violated the Act by revising certain CO limits upward to 130 ppm. This challenge turns on whether EPA supported the conclusion that no further reduction in organic HAP emissions occurs once CO emissions fall below 130 ppm. Because EPA did not, we hold that it acted arbitrarily and capriciously. To explain our conclusion, we first describe in more detail the process by which EPA formulated the challenged limits and review our treatment of closely related issues in U.S. Sugar . We then turn to explaining how EPA failed to adequately justify its decision to revise these limits.

A.

We have long recognized that regulation by surrogate is a tool available to EPA, so long as it establishes that controlling emissions of the surrogate is a "reasonable" way to achieve the Act's objective of limiting emissions of corresponding HAPs. See Sierra Club , 863 F.3d at 838 ; U.S. Sugar , 830 F.3d at 628 . The determination is context-specific, but demanding; we ask whether reducing surrogate emissions would "invariably" and "indiscriminately" reduce the corresponding HAP. See Sierra Club , 863 F.3d at 838 . For example, we have twice affirmed rules that limited hazardous metallic air pollutants by controlling overall emissions of particulate matter (PM), of which the targeted HAP metals were a small but ever-present component. See Sierra Club v. EPA , 353 F.3d 976 , 984-85 (D.C. Cir. 2004) ; Nat'l Lime Ass'n v. EPA , 233 F.3d 625 , 639 (D.C. Cir. 2000). In those cases, we relied on EPA's reasoned conclusions that "each unit of PM emissions avoided 'carries' within it some quantum of HAP metals," Nat'l Lime Ass'n , 233 F.3d at 639 , so that PM controls "inevitably removed *1193 HAPs," Sierra Club , 353 F.3d at 984 . In other words, even if the precise concentration of the pollutant was unknown and might have fluctuated somewhat, "strong direct correlations" linked the targeted substance with the proxy used to measure it. Id. at 985 (alterations omitted) (quoting National Emission Standards for Hazardous Air Pollutants for Source Categories , 65 Fed. Reg. 39,326 , 39,329 (June 26, 2000) ). Those direct correlations-which, in both cases, EPA explained as grounded in a straightforward, natural relationship between the surrogate and the HAP-provided the crucial assurance that a reviewing court requires: A standard based on the performance of the sources that best control emissions of the surrogate will "reflect what the best source or ... sources ... in the relevant subcategory achieved with regard to the HAP ." U.S. Sugar , 830 F.3d at 628 (emphasis added).

Against that backdrop, EPA in the 2011 rulemaking determined that CO was a suitable surrogate for organic HAPs. Noting that CO emissions would be easier to monitor and control than a host of hard-to-measure individual organic HAPs, EPA reasoned that CO limits were an appropriate substitute for the target HAPs because "organic HAP are products of incomplete combustion" and "CO is a good indicator of incomplete combustion." 75 Fed. Reg. at 32,018 . Accordingly, "minimizing CO emissions will result in minimizing non-dioxin organic HAP." Id .

A natural chemical relationship among the relevant molecules undergirded EPA's approach. The record teaches that the basics of that relationship are, roughly, as follows: Combustion occurs when a boiler's fuel-including carbon-containing molecules (hydrocarbons)-is exposed to heat and oxygen, triggering oxidation. See 78 Fed. Reg. at 7145 ; 75 Fed. Reg. at 32,025 . The resulting chemical transformations break down the bulkiest hydrocarbons into smaller ones, then into CO. See 78 Fed. Reg. at 7145 . Further oxidation yields carbon dioxide (CO2) in place of CO-the last step in the combustion process. Id . (Water (H2O) is another byproduct of the combustion process, id ., but its presence is not relevant to EPA's analysis.) Because CO results from incomplete oxidation, more complete combustion leaves less CO (and more CO2) in the resulting emissions stream. By the same token, the more complete the combustion, the lower the emission of organic HAPs-carbon-based molecules that have not been fully oxidized. See 78 Fed. Reg. at 7145 ; 75 Fed. Reg. at 32,025 . Hence the scientific conclusion giving rise to EPA's surrogacy determination: Both CO (not yet replaced by CO2) and organic HAPs (not yet fully broken down) appear in an emissions stream when combustion is not "complete," while driving combustion nearer to "completeness" reduces emissions of both. See 76 Fed. Reg. at 15,654.

Unpersuaded that this correlation was as robust as EPA claimed, Sierra Club protested EPA's decision to use CO as a surrogate for organic HAPs. See U.S. Sugar , 830 F.3d at 630 . Industry, meanwhile, expressed concern about the most stringent CO limits and suggested loosening them. In the 2013 reconsideration, EPA rejected Sierra Club's arguments and accepted industry's, raising the lowest CO limits to the new 130 ppm common threshold. See id. at 628 ; 78 Fed. Reg. at 7144-45 . At that point, while EPA held for further reconsideration that new threshold on the CO limits, environmental petitioners brought to this court their general challenge to use of CO as a surrogate in the first place, and we denied that general challenge in U.S. Sugar .

Sierra Club's position in U.S. Sugar involved two contentions. First, Sierra Club argued that EPA failed to establish a sufficiently *1194 tight correlation between reduced CO and reduced organic HAP emissions, "because record evidence demonstrated a breakdown in th[at] correlation" when CO levels dropped below 130 ppm. U.S. Sugar , 830 F.3d at 630 . Second, it argued that EPA failed to consider whether organic HAP emissions could be even further limited if sources used certain post-combustion controls-such as technologies that extract pollutants from exhaust-instead of or in addition to CO limits. Id. at 629 . In other words, it argued that EPA failed to establish that reliance on CO-based emission limits is both a valid and, when exclusive, sufficient way to achieve the requisite maximum control of organic HAPs.

In U.S. Sugar , we rejected the first line of argument but agreed with the second. On the first, we deferred to EPA's "scientific judgment" that any "apparent breakdown" in the otherwise-strong correlation between CO and organic HAPs was "most likely caused by the difficulty of measuring the regulated HAP at such extremely low emission levels, rather than by a flaw in the correlation." Id. at 630 . On the second, we identified a gap in the record and remanded for EPA to consider "whether the best performing boilers might be using alternative control technologies and methods that reduce organic HAP emissions beyond what they achieve by regulating CO alone," id. at 629 -though we anticipated that EPA would likely be able to justify its purely CO-based approach once it provided the missing information, id. at 630 .

Sierra Club continues to protest both EPA's decision to use CO as a surrogate and the adequacy of the Agency's consideration of post-combustion controls. We addressed those broad contentions in U.S. Sugar . In that case, we remanded to EPA for further consideration of the rule's reliance on CO as a surrogate as a general matter, to the exclusion of alternative control methods. Id . The results of that consideration are not before us, and we do not revisit those arguments here.

But U.S. Sugar did not address EPA's decision, in light of its general reliance on CO as a surrogate for a group of organic HAPs, to establish the 130 ppm lower bound. Our U.S. Sugar remand left all of EPA's CO-based limits intact pending their further consideration, and did not address the levels at which any particular limits were set, only the decision to measure the limits on organic HAP emissions in terms of CO levels. See id. at 630 . We therefore have yet to consider Sierra Club's more specific challenges to the 130 ppm limits, and we do so here. Treating CO as generally a suitable surrogate for organic HAPs, per U.S. Sugar , it remains for us to determine whether EPA's decision in 2013 (reaffirmed in 2015) to loosen the 2011 rule's most stringent CO floors was reasonable and consistent with the Act.

B.

Sierra Club argues that EPA violated the Act and made an arbitrary and capricious decision because the 130 ppm CO threshold in the 2013 final rule weakened standards the agency had earlier promulgated as MACT Floors for thirteen subcategories. EPA responds that its revised CO standards are just as effective as the original ones, assuring us that organic HAP destruction is "complete," or at least "essentially" complete, once CO emissions fall to 130 ppm. Resp't's Br. 18-19. We take EPA to mean that organic HAP emissions are effectively nonexistent-or, in any event, cannot be further reduced-whenever a boiler's CO emissions are below 130 ppm. If articulated and adequately supported in the record, such a position could well satisfy the Act. See 42 U.S.C. § 7412 (d)(2) (EPA "shall require the maximum *1195 degree of reduction in emissions of the [HAPs] subject to this section (including a prohibition on such emissions, where achievable)"). That conclusion would follow from the Act's focus on controlling specifically enumerated HAPs: So long as a surrogate is not itself a regulated HAP-as CO is not-its emissions need not be controlled beyond the point where EPA can be confident that the targeted HAP emissions are reduced as far as possible or, indeed, "eliminat[ed] ... entirely." U.S. Sugar , 830 F.3d at 629 .

But the record does not support any such conclusion here. When settling on the revised 130 ppm floors in 2013, EPA explained that it had set out to determine "whether there is a minimum CO level for boilers and process heaters below which there is no further benefit in organic HAP reduction/destruction." 78 Fed. Reg. at 7144-45 . To make that assessment, the agency looked to data showing the relationship between varying levels of CO emissions and corresponding emissions of formaldehyde-the only organic HAP for which it had such data. Id. at 7144 . On their face, however, those data did not show complete destruction of formaldehyde (or a leveling-off of emissions) as CO dropped below 130 ppm. Id . Nor did the data show continuation at those low levels of the correlation on which EPA's use of CO as a surrogate was based. Instead, "[a]t levels lower than 150 ppm, the mean levels of formaldehyde appear[ed] to increase, as d[ id] the overall maximum value and variability in formaldehyde emissions." Id.

EPA was "aware of no reason why" the otherwise strong correlation between lower CO emissions and lower formaldehyde emissions would suddenly invert. Id. The Agency accordingly determined the data were untrustworthy and that they did not reflect an actual increase in formaldehyde emissions. EPA explained: "[W]e do not believe that such measurements are sufficiently reliable to use as a basis for establishing an emissions limit." Id. We deferred to EPA's scientific judgment on this exact point in U.S. Sugar , rejecting Sierra Club's argument that the imperfect formaldehyde data disproved the general validity of CO as a surrogate and noting EPA's assurances that the "apparent breakdown" of the relationship between formaldehyde and CO below 130 ppm "was most likely caused by the difficulty of measuring the regulated HAP at such extremely low emission levels." U.S. Sugar , 830 F.3d at 630 .

In separately attempting to justify its conclusion that CO limits would not yield further reduction in organic HAPs if set below the level where the formaldehyde data became unreliable, however, EPA relied on the same data it had elsewhere decisively characterized as untrustworthy. EPA asserted in support of its decision to reject any limit more stringent than 130 ppm that, "[a]t CO levels less than [130 ppm], our data indicate that there is no apparent relationship between CO and organic HAP (i.e., formaldehyde)." 78 Fed. Reg. at 7145 (emphasis added). In other words, EPA's only support for its upward-revised floors was the very data it had just dismissed as inaccurate, now cited as reliable evidence that reducing CO below 130 ppm does not in fact reduce organic HAP emissions.

That mismatch-treating data EPA had viewed as not reliable at low emission levels as if it were affirmative support for a breakdown of the correlation at those levels-makes EPA's decision arbitrary and capricious. EPA concluded that the otherwise well-documented general correlation between CO and organic HAPs does not persist below 130 ppm without providing a reasoned basis for its conclusion. Importantly, EPA was regulating against the *1196 backdrop of its own prior, general determination that CO was a surrogate for organic HAPs; it had concluded "that minimizing CO emissions will result in minimizing ... organic HAP." 75 Fed. Reg. 32,018 . "EPA proposed using CO as a surrogate because ... the lowest possible CO emissions resulted in the lowest possible HAP emissions ...." U.S. Sugar , 830 F.3d at 629 .

In U.S. Sugar , we relied on EPA's conclusion that there was tight correlation between reduced CO and reduced organic HAP emissions to affirm EPA's rule in part. See id. at 630 . We treated that conclusion as supported by both the formaldehyde emissions data and the scientific principle underlying them: For reasons EPA explained, we accepted that incomplete combustion yields levels of CO and organic HAP emissions that correlate very closely to one another. See id. at 628, 630 . EPA's refusal to extend that same logic to CO levels below 130 ppm requires a reasoned justification. The Agency failed to provide one.

EPA came closest to a reasoned determination that the surrogacy relationship broke down below 130 ppm in its assertion that CO is a "conservative" surrogate for organic HAPs because it is "a difficult to destroy refractory compound." 78 Fed. Reg. at 7145 . Although EPA did not define the term, one way to understand EPA's characterization of CO as a "conservative surrogate" is that organic HAPs might all burn up in the combustion process at a level of completeness where some CO emissions remained, because "oxidation of CO to carbon dioxide is the slowest and last step of oxidation of hydrocarbons." Id. If that is true, there could theoretically be some nonzero level of CO emissions below which no further reduction in organic HAP emission occurs, because the HAPs would be all gone (or perhaps still present in low amounts, yet impervious to combustion) before CO emissions ceased.

When justifying its rule, however, EPA did not say that organic HAP emissions are eliminated completely (or not susceptible of any further reduction) below 130 ppm, nor has it explained how any such theory follows from the only available record evidence-the formaldehyde data on which EPA otherwise exclusively relied. We cannot sustain an agency's decision on grounds it did not invoke. See SEC v. Chenery , 332 U.S. 194 , 196, 67 S.Ct. 1760 , 91 L.Ed. 1995 (1947).

Three points highlight the lack of basis to sustain the rule on a novel, "conservative surrogacy" ground. First, during the rulemaking process, EPA never took the position that organic HAP emissions fall to zero, nor gave any reason why they could not be further reduced, once CO emissions reach 130 ppm. It said only that, where CO is emitted at or below 130 ppm, organic HAP emissions are "extremely low." 78 Fed. Reg. at 7145 ; see also U.S. Sugar , 830 F.3d at 630 . But describing HAP levels as "low," even "extremely low," or saying that their combustion is "essentially" complete, implies that HAPs have not been entirely eliminated. So EPA's observation that HAP emissions are "extremely low" when CO is at 130 ppm is not a reasoned basis for concluding that organic HAP emissions cannot be reduced still further. There is no "close enough" exception to the requirement that EPA's MACT floors limit emissions to the full extent shown to be achievable by the best-performing sources; to the contrary, the Act's MACT provisions instruct EPA to "maximize" the reduction in emissions, up to and including "a prohibition on such emissions, where achievable." 42 U.S.C. § 7412 (d)(2).

Second, the formaldehyde data on which EPA generally relied are the only data EPA offered for its decision not to require that CO emissions be reduced below 130 *1197 ppm, and EPA staked its "conservative surrogate" theory on those data. See 78 Fed. Reg. at 7145 . But, in virtually the same breath, EPA said those data were not a reliable indicator of what happens to organic HAP emissions at the low levels in question. Again, that contradiction leaves us unable to discern any reasoned basis for determining that organic HAPs disappear from the emission stream before CO does, or to otherwise conclude that organic HAP emissions cannot be further reduced.

Third, even if EPA had grounds to conclude that there is some nonzero level of CO emissions that marks a point below which organic HAP emissions cannot be further reduced, it offered no basis for identifying 130 ppm as that level. As just noted, EPA cites only the unreliable formaldehyde data-which, on average, show HAP emissions increasing below 150 ppm of CO, not leveling off or zeroing out. See id. Accepting that boomerang as a data flaw, and not as an accurate representation of a shift in the physical correlation between CO and HAP combustion, it is not evident how those unreliable data could support a conclusion that emissions in fact plateau at their lowest achievable level, rather than either increasing or continuing to decrease, at an inflection point of 130 ppm. EPA has not explained how the data could suffice.

Industry intervenors' brief (but not EPA's) seeks to bolster the evidence in the record by reference to two prior rules in which EPA set CO limits at a level equivalent to what EPA defends here. The conclusions reached in those other rulemakings are irrelevant under our precedent, which takes "every tub on its own bottom" when setting emissions standards under the Act; EPA must justify its conclusions in each proceeding. U.S. Sugar , 830 F.3d at 623 (quoting SierraClub , 353 F.3d at 986 ). It is not enough to have reached the same (unreviewed) conclusion elsewhere.

EPA did not in the rulemaking here rely on either of the prior rules to which intervenors cite, nor on the records supporting them. That makes sense because in neither prior rulemaking did EPA reach, much less justify, the specific conclusion that EPA has failed to support here: that a 130 ppm CO level suffices to eliminate organic HAP emissions, or that further reductions are not possible beyond that point. The first rule, promulgated in 1991 under the Resource Conservation and Recovery Act (RCRA), 42 U.S.C. § 6901 et seq ., limited organic matter emissions only to a level that would not "pose a significant risk," as that statute required; it did not conclude that 130 ppm was the maximum achievable reduction. Burning of Hazardous Waste in Boilers and Industrial Furnaces , 56 Fed. Reg. 7134 , 7151 (Feb. 21, 1991). And, in finalizing the second cited rule, a 2005 restriction on hazardous waste combustors, EPA concluded only that CO levels below 130 ppm "may not provide significant reductions in organic HAP emissions" because such emissions are "extremely low" when CO levels are "in the range of zero to 100 ppm[ ]" (corrected to seven percent oxygen, which is equivalent to 130 ppm when corrected to three percent oxygen). See National Emission Standards for Hazardous Air Pollutants: Final Standards for Hazardous Air Pollutants for Hazardous Waste Combustors (Phase I Final Replacement Standards and Phase II) , 70 Fed. Reg. 59,402 , 59,462 (Oct. 12, 2005). In neither case did EPA conclude that no below-130 ppm CO emissions limit would improve the control of HAPs.

EPA alternatively suggests that this court in U.S. Sugar already decided this issue in its favor, but we did not. We rejected the environmental petitioners' argument in that case that "record evidence demonstrated a breakdown in the correlation between CO and organic HAP emissions below 130 ppm" such that EPA acted *1198 arbitrarily in relying on CO as a surrogate. U.S. Sugar , 830 F.3d at 630 . In accepting the relationship between CO and HAP combustion as a general matter, we deferred to EPA's conclusion that there was only an "apparent" breakdown in that relationship-a breakdown "most likely caused by the difficulty of measuring the regulated HAP" at those levels, rather than by variability in the underlying relationship. Id . We did not endorse the conclusion that EPA now advances-that the data affirmatively prove an absence of further reductions.

Given these deficiencies in EPA's reasoning, we cannot discern the "reasonable connection to the facts in the record" necessary to defer to EPA's decision to revise these CO floors. U.S. Sugar , 830 F.3d at 829 ; see also Motor Vehicle Mfrs. Ass'n of the U.S. v. State Farm Mut. Auto. Ins. Co. , 463 U.S. 29 , 43, 103 S.Ct. 2856 , 77 L.Ed.2d 443 (1983). EPA may have a hunch that setting CO limits below a certain level would be ineffectual to control HAP emissions. But the record we have before us does not substantiate any such conclusion, much less provide a basis for pinpointing that level at 130 ppm.

It would be particularly inappropriate to give EPA a pass on backing up its apparent hunch here, where EPA was operating against the backdrop of its own prior reasoned judgment that "minimizing CO emissions will result in minimizing non-dioxin organic HAP," 75 Fed. Reg. 32,018 , and where its conclusion appears to be counter to the only empirical evidence EPA had before it. See State Farm , 463 U.S. at 43 , 103 S.Ct. 2856 . If EPA concludes that the relationship it previously identified between CO and organic HAP is actually valid only to a point-a conclusion the likes of which our prior regulation-by-surrogate cases have not endorsed-it must explain how the limiting point it specifies reflects the emission control actually achieved by the best performing sources and, further, that it is the lowest emission level achievable with existing technology.

We therefore remand to EPA to reconsider its decision to adopt the 130 ppm CO limits. We do not vacate those limits, because Sierra Club has asked us not to do so and because "vacatur would cause substantial disruptive effects by removing emissions limits for the regulated HAPs." U.S. Sugar , 830 F.3d at 630 . EPA may, if it finds it feasible to do so, undertake this reconsideration in conjunction with the broader task we gave EPA when remanding in U.S. Sugar : To further consider "the portion of the Major Boilers Rule providing for CO's use as a surrogate for non-dioxin/furan organic HAPs." Id .

Because we remand, we need not pass on Sierra Club's additional contention that EPA failed to consider beyond-the-floor standards under 42 U.S.C. § 7412 (d)(2). In revisiting the CO-based standards (in light of both this decision and U.S. Sugar ), however, EPA must consider both (1) whether the standards it adopts are Section 7412(d)(3) -compliant MACT Floors and (2) whether Section 7412(d)(2) beyond-the-floor standards are called for here. See Nat'l Lime Ass'n , 233 F.3d at 634-35 .

III.

Sierra Club also challenges EPA's startup and shutdown work practice standards as arbitrary and capricious and contrary to the Act. It challenges the duration of the startup period EPA allows, as well as the content of both the startup and shutdown work practices EPA prescribed. Sierra Club contends that EPA's approach to the duration of startup arbitrarily and unlawfully gives all sources four extra hours before they must begin complying with numeric standards, even though some sources admittedly can achieve stable operations in less time. Sierra Club also *1199 claims that the work practices EPA requires during startup are arbitrary and unlawful because they do too little to reduce emissions-most notably by allowing boiler operators latitude to activate many pollution controls only when "possible." See 80 Fed. Reg. at 72,824. Finally, Sierra Club contends that the shutdown work practice provisions are too lenient and are internally inconsistent.

We first summarize the content of the challenged standards and how EPA developed them. We then analyze Sierra Club's claims against the standards as finalized.

A.

The startup and shutdown work practice standards EPA finalized in 2015 were the product of considerable trial and error. In its 2011 final rule, EPA concluded that a work practice standard was called for during startup and shutdown because it was "not technically feasible" for the regulated boiler operators to conduct the emissions testing necessary to enforce numeric limits. 76 Fed. Reg. at 15,613. Sierra Club does not contest that finding, at least not as a general matter. The content of the original 2011 rule was, however, notably meager: It required boiler operators only to "follow[ ] the [boiler] manufacturer's recommended procedures for minimizing periods of startup and shutdown." Id.

The 2013 iteration of the rule began to make its requirements more specific. It gave startup a defined end point: "when steam or heat is supplied for any purpose." 78 Fed. Reg. at 7146 . It required boiler operators to use certain enumerated clean fuels to initiate startup, and to "engage all of the applicable [pollution] control devices" upon transitioning to the boiler's primary fuel, except that four specified devices needed only to be engaged "as expeditiously as possible." 78 Fed. Reg. at 7199 . Shutdown practice was essentially the inverse: EPA defined shutdown to begin when the boiler stopped generating useful steam or heat, or "at the point of no fuel being fired ..., whichever is earlier." Id. at 7147 . As long as primary fuel kept firing during shutdown, boiler operators, again, had to "operate all applicable control devices, except" the specified four. Id. at 7199 . And, during both periods, boiler operators had to collect and report monitoring data. Id .

EPA concluded that additional public comment could help it further refine the startup and shutdown provisions, so it initiated the reconsideration process that gave rise to the 2015 rule. 80 Fed. Reg. at 3092. The agency proceeded cautiously through what it treated as a delicate balancing act. On the one hand, EPA had determined numeric standards were infeasible because boiler conditions were too variable while heating up and cooling down, and the agency had scant data about those volatile periods. 76 Fed. Reg. at 15,641 -42. EPA had also recognized serious risks of explosions and equipment damage that might result if it required operators to engage pollution controls too early, while boiler conditions remained in flux. 80 Fed. Reg. at 3094 ; see also Response to Comments at II-6, J.A. 354. EPA accordingly was attentive to industry concerns that it not set the end of startup too early or impose otherwise unrealistically demanding standards.

At the same time, EPA's work practice standards had to be "consistent with" the Act's MACT stringency provisions. See 42 U.S.C. § 7412 (h)(1) ; U.S. Sugar , 830 F.3d at 663 . EPA also had some evidence that emissions might be elevated during startup, Response to Comments at II-11, J.A. 359; id. at II-28, J.A. 364, and was aware that, the sooner startup ended, the sooner boiler emissions would be subject to numeric limits. EPA thus aimed to transition boilers to numeric limits as soon as the *1200 best-performing units could achieve stability. See 80 Fed. Reg. at 3094.

The 2015 rule, as proposed and finalized, balanced those considerations in two ways. First, faced with evidence that many boilers could not achieve stable operations as soon as they began supplying useful steam or heat, EPA set its primary definition of the startup period to end four hours after a boiler first supplies "useful thermal energy"-i.e., provides the steam or heat that is its raison d'être . 80 Fed. Reg. at 72,824. Although EPA had scant data about the boilers to be regulated, it had a better dataset on technologically similar boilers whose primary function is electricity generation. Those boilers are subject to a different regulatory regime under which EPA collects hourly operations data. Response to Comments at II-5-6, J.A. 353-54. Using those data, EPA calculated that the best-performing twelve percent of those electricity-generating boilers achieved stable operations four hours after they began supplying useful thermal energy. 80 Fed. Reg. at 72,795 ; 80 Fed. Reg. at 3094.

Second, EPA further adjusted its work practices, making all pollution control devices subject to the "as expeditiously as possible" standard, with the exception of particulate matter controls that EPA required operators to engage within one hour of first using fuels other than the clean fuels specifically mandated for use during startup (as opposed to the dirtier fuels consumed during ordinary operation). 80 Fed. Reg. at 72,824. Operators who can show that they are unable safely to meet the one-hour timeframe and have a control device adequately designed and sized to meet the filterable PM emission limit may seek a case-specific time extension from the relevant permitting authority. Id. EPA also added a requirement that every source operator "develop and implement a written startup and shutdown plan," id. , while retaining the requirement that it monitor, record, and report data concerning fuel usage, boiler conditions, and control device operations, 80 Fed. Reg. at 72,816, 72,824.

At the same time, the 2015 rule also retained the shorter 2013 definition of startup as an alternative, letting boiler operators opt into it if they can meet it. 80 Fed. Reg. at 72,824. EPA was aware that at least some industrial boilers could achieve stability more quickly than the average of the best-performing electricity generators. See Response to Comments at II-4-5, J.A. 352-53. Because it did not know precisely which boilers could do so, however, it retained the faster startup definition as an option, offering those earliest-to-stabilize boilers an incentive to opt for the faster definition by pairing that standard with leaner recordkeeping and reporting obligations than EPA requires of operators starting up more slowly. See 80 Fed. Reg. 72,816 -17; 80 Fed. Reg. at 3094. That approach was crafted with one eye to the future periodic reviews the Act requires. See 42 U.S.C. § 7412 (d)(6). Once boiler operators either provide improved data to EPA or opt for the shorter startup period and succeed in complying with it, EPA assures us that it will consider further refining and tightening these standards. Resp't's Br. 40.

The changes coming out of EPA's reconsideration focused on the startup provisions; the 2015 shutdown provisions were, for our purposes, essentially unchanged from 2013. See 80 Fed. Reg. at 72,824.

B.

Sierra Club contends, first, that EPA acted arbitrarily and unlawfully by allowing boiler operators to define startup to extend four hours beyond when a boiler begins supplying useful energy. Specifically, Sierra Club contends that EPA should not have subjected any boilers to a work *1201 practice standard during that four-hour window without first making a finding under 42 U.S.C. § 7412 (h)(2) that it is "not practicable" to impose numeric limits on the relevant "particular class of sources" during that four-hour window. Sierra Club asserts that EPA has not done so here because, by retaining the shorter startup period as a compliance option, the agency implicitly conceded that some sources can comply sooner.

But EPA did determine that, for the class of industrial boilers as a whole, four hours after beginning to supply useful energy was a reasonable estimate of how long the best performers' operations would remain unstable. 80 Fed. Reg. at 3094. EPA had "very limited information" about the industrial boilers under consideration. Id. And EPA's efforts to obtain more information through notice and comment in the double-reconsideration process yielded only industry-provided survey data that were of limited utility. Id. EPA accordingly estimated time-to-stability for all of the boilers in this category based on the closest analogue at hand: the best performing electricity-generating boilers. Id. EPA's authority to resort to a work practice standard does not depend on its determining that numerically gauging emissions would be impractical throughout the entire startup period for every single source to which a work practice applies; the Act requires only that EPA determine that it is impractical to measure emissions for the "particular class of sources" at issue. 42 U.S.C. § 7412 (h)(2)(B).

Though EPA was painting in broad strokes, its approach was reasonable. EPA knew boilers had heterogeneous startup processes, and it reasonably concluded that startup performance (and associated variability) was not correlated with any easily isolated boiler characteristics. This left EPA with no basis on which to apply different definitions of startup to different boilers by subcategorizing them into different "classes" or "types." 42 U.S.C. § 7412 (d)(1).

EPA was, as it acknowledged, working from "very limited information specifically for industrial boilers." 80 Fed. Reg. at 3094. But here we "defer to [EPA]'s decision to proceed on the basis of imperfect scientific information, rather 'to invest the resources to conduct the perfect study.' " Sierra Club v. EPA , 167 F.3d 658 , 662 (D.C. Cir. 1999) (quoting Am. Iron & Steel Inst. v. EPA , 115 F.3d 979 , 1004 (D.C. Cir. 1997) (per curiam) ); see also Cement Kiln Recycling Coal. v. EPA , 255 F.3d 855 , 867 (D.C. Cir. 2001) (quoting Sierra Club , 167 F.3d at 662 ). EPA applied its expertise to determine that electricity-generating units had sufficient technological similarity to industrial boilers for data on the former to also inform operations of the latter. 80 Fed. Reg. at 3094. Four hours after supplying useful thermal energy was the time the best-performing twelve percent of those analogous boilers took before engaging controls, so their data gave EPA a reasonable basis for concluding that its definition was consistent with MACT. See id. EPA's data, though admittedly scant, pass muster in part because EPA's reliance thereon is only a stopgap; as noted, the data-collection and recordkeeping requirements in EPA's work practices standard are designed to generate more directly relevant data that promise to provide grounds to further revise the rule (or to confirm its appropriateness).

Sierra Club disputes whether data showing when electricity-generating units engage controls may reasonably be thought to reflect the earliest time at which they are capable of doing so. A premise of Sierra Club's argument is that electricity-generating boiler operators might not engage controls at the first opportunity "absent a regulatory requirement." Pet'rs' Br.

*1202 50. But electricity-generating boilers face such requirements; EPA has so much data on them precisely because they are subject to-among various federal and state regulatory regimes-the Clean Air Act's Acid Rain program, 80 Fed. Reg. at 3094, which follows a market-based cap-and-trade approach that attaches costs to each unit of uncontrolled emissions, see North Carolina v. EPA , 531 F.3d 896 , 902 (D.C. Cir. 2008). EPA could reasonably assume that operators of the best-performing electricity-generating boilers engage controls at their earliest opportunity.

Sierra Club also contends that EPA, in retaining the 2013 rule's shorter startup definition as an alternative compliance option, impermissibly delegated its impracticability determination to the regulated boiler operators. Sierra Club's premise is that only the shorter definition may lawfully apply, unless EPA makes boiler-specific impracticability determinations justifying longer startup. As just discussed, however, the longer startup period represented EPA's reasoned estimate of what the best-performing twelve percent of industrial boilers could achieve. It is thus reasonable and consistent with the statute. Sierra Club does not contend that the longer definition would have been unlawful if EPA had imposed it alone, without the shorter alternative. Sierra Club's claim thus reduces to little more than an objection to allowing boiler operators to choose between two options.

EPA's approach was reasonable here. EPA concluded by the time it issued the 2015 rule that the more stringent standard it had imposed (without a longer allowance for startup) in the 2013 version of the rule was beyond what all the boilers in the top twelve percent benchmark group could accomplish, but that it might nonetheless be achievable for some. Because EPA did not know precisely which boilers could meet the more stringent timeframe, it encouraged those that could do so to identify themselves and opt into complying with numeric emissions limits sooner than they would otherwise have to. That creative approach reasonably offered eased recordkeeping and reporting as an incentive for a subset of industrial boilers to reduce emissions further than EPA could otherwise require, even as EPA recognized the need to collect additional data from the rest of the field.

C.

Sierra Club also challenges the remaining content of EPA's work practice standards as not sufficiently demanding. We conclude that, despite imperfect data about industrial boiler startup and shutdown, EPA reasonably accommodated what it identified as legitimate safety concerns in deciding what work practices were achievable. Evidence in the administrative record shows that, while starting up and shutting down, industrial boilers are prone to "overheating," "[l]eaks," and "thermal stresses" if not carefully managed. Response to Comments at II-5-6, J.A. 353-54. It also reveals that "startup and low load operations" place boilers at heightened risk of "furnace explosions." Id . at II-6, J.A. 354. Engaging certain control technologies too early, EPA learned, could be not just dangerous but counterproductive: Running a given device below a certain temperature or pressure "could permanently destroy ... its performance potential." Id. At the same time, EPA was told that startup procedure "varies widely" across boilers. 80 Fed. Reg. at 3094. EPA therefore reasonably fashioned relatively contextual work practice standards.

Sierra Club first contends that EPA's requirement that boilers engage most pollution control devices "as expeditiously as possible" is tantamount to the empty "general duty" standard we invalidated in *1203 Sierra Club v. EPA , 551 F.3d 1019 , 1026-28 (D.C. Cir. 2008). But the rule we rejected in that case was quite different: It eschewed defining obligations altogether, relying instead on the regulated community's background "general duty" to limit emissions in a manner "consistent with good air pollution control practice for minimizing emissions." Id. at 1022 (quoting 40 C.F.R. § 60.11 (d) ). We rejected that approach because it neither set a numeric emissions limit nor followed Section 112(h)'s requirements for setting work practice standards during startup and shutdown. Id. at 1027-28 . Sierra Club thus held that, whenever HAP sources are in operation, including during startup and shutdown, EPA must continuously subject them to either numeric limits or Section 112(h)-compliant work practice standards.

Here, because EPA chose to regulate startup and shutdown via work practice standards, the question before us is whether those standards comport with Section 112(h). We conclude that they do. Sierra Club's contention that the work practice standards here challenged are akin to the contentless "pollute as little as you can" edict we rejected in Sierra Club in 2008 overlooks that the requirement at issue here has substantive content that was missing from that rule. The general duty requirement we deemed inadequate in Sierra Club was limited to the admonition that "owners and operators shall, to the extent practicable, maintain and operate any affected facility ... in a manner consistent with good air pollution control practice for minimizing emissions." Id. at 1022 (quoting 40 C.F.R. § 60.11 (d) ). Here, by contrast, the requirement to start certain pollution control devices "as expeditiously as possible" applies to specific devices and is just one aspect of a multifaceted work practice standard. 80 Fed. Reg. at 72,824. The standard also includes (most notably) requirements to initiate startup with clean fuels, and to start particulate matter controls at a specified time. Id. And EPA built an implicit emissions limitation into the startup definition itself, by pegging it to the production of useful energy. Boiler operators lack incentives to combust fuel for no useful purpose, simply as a means to avoid engaging pollution controls, so presumably they do not tarry in heating their equipment to that point. By requiring numeric-standard compliance as soon thereafter as possible, the rule minimizes emissions by ensuring startup is not needlessly drawn out. Cf. U.S. Sugar , 830 F.3d at 666-67 (approving a work practice standard that required boiler operators to minimize the duration of startup and shutdown). That reality reinforces EPA's conclusion that its work practice standard has constraining effect that a general-duty standard lacks. EPA's work practices are admittedly less than exacting, but they are materially more precise and demanding than the general duty standard we disapproved in Sierra Club in 2008.

Petitioners further contend that the work practice standards impermissibly delegate to boiler operators decisions about what is achievable with respect to many pollution control devices, and, relatedly, that a standard that varies depending on what is practicable for each individual boiler is contrary to the technology-forcing design of § 7412(d). Despite the generality of "as expeditiously as possible," we accept EPA's reasoning as to why it is a meaningful constraint. The rule requires each boiler operator to create a written startup and shutdown plan and make it available for public inspection. 80 Fed. Reg. at 72,795 ; 80 Fed. Reg. at 3095. And, more generally, these boilers are subject to enhanced permitting and recordkeeping requirements applicable to all major sources-requirements that enable EPA, state regulators, and interested third parties to check the boiler operators' homework. Those obligations include periodic "compliance certifications"

*1204 that describe how the boiler is meeting each applicable requirement-including the work practice standards. See 42 U.S.C. § 7414 (a)(3) ; 40 C.F.R. § 70.6 (c)(5)(iii) ; Nat. Res. Def. Council, Inc. v. EPA , 194 F.3d 130 , 132-34 (D.C. Cir. 1999). Boiler operators thus must at all times be able to explain why they cannot engage controls sooner than they do, and EPA's work practices specifically require sources to monitor and record data about conditions that guide their determinations, such as temperature and pressure inside the boiler. 80 Fed. Reg. at 72,816 -17. Those obligations put in place meaningful avenues to double check boiler operators' assertions about what is possible. Moreover, data EPA gathers while these rules are in effect should inform the case-by-case determinations as well as future refinements of these rules when they are periodically reviewed.

In sum, having reasonably discerned that sound operation of this heterogeneous class of boilers requires allowing operators some discretion to determine the earliest time when certain control devices can safely come online, EPA permissibly concluded that its work practices were "consistent with" the Act's MACT approach. See U.S. Sugar , 830 F.3d at 663 . The record corroborates EPA's concerns about equipment safety if controls were subject to across-the-board engagement times, and its conclusion that boiler operating constraints during startup and shutdown vary widely. Section 7412(h) -the provision authorizing EPA to adopt a "design, equipment, work practice, or operational standard, or combination thereof" in lieu of an emissions standard-centrally relies on "the judgment of the Administrator" regarding when an emissions standard is not feasible, and "the Administrator's judgment" as to whether the standard is appropriately stringent to meet the statute's objectives. 42 U.S.C. § 7412 (h)(1) ; see U.S. Sugar , 830 F.3d at 663 . That judgment of course must be guided by permissible factors. One such factor here was known technological limitations on the use of control devices during the volatile conditions that characterize startup. See U.S. Sugar , 830 F.3d at 664-65 . Tellingly, Sierra Club struggles to identify what more EPA could realistically have required of boiler operators.

D.

Finally, we address Sierra Club's contentions that the shutdown provisions are too lax. Specifically, Sierra Club argues that EPA should not exempt enumerated control devices-dry scrubbers, fabric filters, selective catalytic reduction, and (for fluidized bed boilers) limestone injection-from operation during shutdown, and it asserts that EPA "claimed to have required boilers to use clean fuels during shutdown, when in fact it did not do so." Pet'rs' Br. 46. The first argument fails for reasons similar to those that led us to uphold the startup provisions. EPA requires boilers to "operate all applicable control devices, except " the enumerated four during shutdown, 80 Fed. Reg. at 72,824 (emphasis added), having reasonably concluded that the exempted control devices could not safely be operated under conditions encountered during shutdown. See, e.g. , 78 Fed. Reg. at 7147 .

And the second argument is a semantic quibble that overlooks the reality of how shutdowns unfold. It is technically true that, under EPA's work practice standard, boilers may sometimes use no clean fuels, and some fuels that are not clean, during shutdown. That is because shutdown requires gradually cooling a boiler, which involves phasing out the boiler's primary fuel. Secondary fuels may be burned during this process to, for example, help stabilize cooling, but they are not always needed. Accordingly, the shutdown work practices require the use of clean fuels "[i]f, in addition to the fuel used prior to *1205 initiation of shutdown, another fuel must be used" during that process. 80 Fed. Reg. at 72,824. Whenever that happens, the regulations-as EPA accurately notes-require those fuels to be clean.

Sierra Club is right that the rule contemplates that some amount of "the fuel used prior to initiation of shutdown"-i.e., the boiler's primary, and thus relatively "dirty," fuel-may sometimes be burned during shutdown, which might seem inconsistent with a requirement to use clean fuels. But, again, any permissible use of fuels during shutdown necessarily must unfold as a practical matter; it does not reflect any sleight of hand by EPA. Shutdown primarily consists of gradually phasing out the boiler's primary fuel, and EPA's shutdown work practices apply beginning either at the point in that process when useful energy is no longer supplied "or when no fuel is being fed to the boiler ..., whichever is earlier." Id. at 72,818. So a boiler may sometimes burn its primary fuel while shutdown work practices are in effect, but only after the boiler has cooled beyond the point of supplying useful thermal energy-in other words, during a brief window when some dwindling amount of primary fuel is still being phased out. Apart from that narrow window when useful energy production has ceased and the boiler is still cooling, any fuel that is burned during shutdown must be "clean." EPA has not mischaracterized its rule.

* * *

For the foregoing reasons we grant in part and deny in part the petitions for review, and remand to EPA the CO limits for which EPA adopted a revised limit of 130 ppm for further proceedings consistent with our opinion.

So ordered.