ALTMAN, District Judge:

In 2016, our Appellant—Lynette Christmas—was sexually assaulted by Thomas Pierson, a deputy sheriff in Harris County, Georgia, who’s now serving an eight-year prison term. In the part of this civil-rights lawsuit that’s before us, Christmas has sued Harris County and Robert Jolley, the Sheriff of Harris County, alleging that Jolley failed in various ways to prevent Pierson from assaulting her. 1 Finding that Jolley was entitled to qualified immunity, the district court granted summary judgment for Jolley—a decision that, after careful review, we now affirm.

* The Honorable Roy K. Altman, United States District Judge for the Southern District of Florida, sitting by designation. 1 Although Christmas has included Harris County as a party to this appeal, the district court dismissed Harris County from the case early on in this litigation, and Christmas has advanced no arguments in her brief as to any issue relating to Harris County. We’ll therefore consider this appeal only as a challenge to the entry of summary judgment in favor of Sheriff Jolley.

I. THE FACTS

On February 14, 2016, Christmas was driving towards Columbus, Georgia, to meet a friend for lunch when Pierson pulled her over. The two spoke for a bit until Pierson concluded the stop by issuing Christmas a written warning. Before letting her go, though, Pierson suggested that Christmas meet him at a nearby side road, where the pair could continue their conversation “unfil- tered.” Christmas got back into her car and initially intended to drive away. But, when Pierson got behind her in his cruiser and activated his lights, she felt compelled to pull into the side road next to him. Once there, Pierson forced Christmas to perform oral sex on him.^[2]

Later that same day, a shocked and distraught Christmas stopped by the Pike County Sheriff’s Office to report the assault. That office relayed the information to the Harris County Sheriff’s Office, whose elected Sheriff was our Appellee, Robert Jolley. Jolley immediately investigated the allegations and brought Pierson in for questioning. When Pierson confessed the next day, Sheriff Jolley—who’d once fired a deputy for dating someone the deputy had met on duty—terminated Pierson.

Sheriff Jolley also engaged the Georgia Bureau of Investigation (“GBI”) to help launch a broader inquiry into Pierson’s conduct. As part of that inquiry, Sheriff Jolley sent letters to every person Pierson had pulled over (and issued written warnings to) during the six months before his encounter with Christmas. Two women responded. The first, whom the parties identify as C.T., claimed that Pierson made sexually inappropriate comments to her during a traffic stop on September 12, 2015, and that he later followed her (against her will) to her grandmother’s house. The second, L.F., reported that—during a traffic stop on October 19, 2015—Pierson showed her a video of himself having sex with a woman and added that Pierson unexpectedly showed up to her home the next day. A third woman, M.A., separately contacted the GBI and claimed that Pierson offered to let her go from a traffic stop on September 4, 2015, without a citation if she agreed to perform oral sex on him, which she did. There’s no evidence, however, that Sheriff Jolley knew about any of these incidents until after the GBI had completed its investigation—which, as we’ve said, took place after Pierson assaulted Christmas.

At the time of Christmas’s assault, Sheriff Jolley was aware of two other incidents involving Pierson. The first happened on August 31, 2015, when Nicholas Dyksma (18 years old) died in the custody of Pierson and other Harris County officers following a high-speed chase. A video recording of the arrest shows Pierson holding his knee to Dyksma’s neck even after Dyksma was hand- cuffed. Seeking redress, Dyksma’s family brought an excessive-force claim against, among others, Pierson in the Middle District of Georgia. In July of 2018, the district court in that case rebuffed Pierson’s request for qualified immunity and denied his motion for summary judgment. Sheriff Jolley never reprimanded Pierson for his role in Dyksma’s arrest, and he never directed Pierson to un- dergo additional training.

In the second incident—which took place on December 10, 2015—Pierson’s ex-wife called Sheriff Jolley to report that Pierson was following her in his police vehicle. Sheriff Jolley directed his chief deputy to look into her allegations, but the chief deputy determined that Pierson hadn’t been working that day, so no formal investigation was opened. Pierson’s ex-wife never followed up with a written complaint.

On July 22, 2016, a Georgia grand jury returned a twelve- count indictment, charging Pierson with sexual assaults against Christmas, C.T., and L.F. Pierson proceeded to trial where, on August 30, 2017, a Georgia jury found him guilty of two counts of Sexual Assault on a Person in Custody, four counts of Violation of Oath by a Public Officer, one count of False Imprisonment, and one count of Tampering with Evidence. He remains incarcerated.

Christmas filed this civil-rights lawsuit on March 28, 2019. In it, she asserted several federal and state-law claims for damages against Pierson, Sheriff Jolley, and Harris County. The district court dismissed most of those claims, allowing discovery only on her § 1983 claims against Pierson and Sheriff Jolley in their individual capacities. As relevant here, Christmas’s § 1983 claim against Sheriff Jolley was premised on a theory of “supervisory liability”: She alleged, for example, that he “had reason to know that Pierson would act unlawfully[,] but failed to stop him from doing so.” Christmas further averred that Sheriff Jolley “had a policy or practice of not tracking officers who had already been accused of constitutional violations and allowing them to continue in their job,” and that his policy “caused the constitutional violations that occurred in Pierson’s encounter with [her].”

On August 21, 2020, Sheriff Jolley moved for summary judgment. He argued that Christmas hadn’t established her supervisory-liability claim and that, even if she had, he was entitled to qualified immunity. On December 29, 2020, the district court granted Sheriff Jolley’s motion. And, on March 31, 2021, the district court certified final judgment under FED. R. CIV. P. 54(b) in favor of Sheriff Jolley and Harris County.^[3] This appeal followed.

II. STANDARD OF REVIEW

We review the district court’s order granting Sheriff Jolley’s summary-judgment motion de novo, taking the facts in the light most favorable to Christmas. See Lee v. Ferraro, 284 F.3d 1188, 1190 (11th Cir. 2002) (“In conducting de novo review of the district court’s disposition of a summary judgment motion based on qualified immunity, we are required to resolve all issues of material fact in favor of the plaintiff.” (citing Sheth v. Webster, 145 F.3d 1231, 1236 (11th Cir. 1998))). “We then answer the legal question of whether the defendant[ ] [is] entitled to qualified immunity under that version of the facts.” Ibid. (quoting Thornton v. City of Macon, 132 F.3d 1395, 1397 (11th Cir. 1998)).

III. DISCUSSION

“Qualified immunity offers complete protection for government officials sued in their individual capacities if their conduct ‘does not violate clearly established statutory or constitutional rights of which a reasonable person would have known.’” Vinyard v. Wilson, 311 F.3d 1340, 1346 (11th Cir. 2002) (quoting Harlow v. Fitzgerald, 457 U.S. 800, 818 (1982)). By imposing liability only for violations of clearly established law, the defense of qualified immunity “balances two important interests—the need to hold public officials accountable when they exercise power irresponsibly and the need to shield officials from harassment, distraction, and liability when they perform their duties reasonably.” Pearson v. Callahan, 555 U.S. 223, 231 (2009).

To qualify for the immunity, the official “must first prove that he was acting within the scope of his discretionary authority when the allegedly wrongful acts occurred.” Lee, 284 F.3d at 1194 (quoting Courson v. McMillian, 939 F.2d 1479, 1487 (11th Cir. 1991)). In our case, the district court held that, in supervising Pierson, Sheriff Jolley was at all times acting within the scope of his discretionary authority, and Christmas doesn’t contest that finding on appeal.

Where, as here, “the defendant establishes that he was acting within his discretionary authority, the burden shifts to the plaintiff to show that qualified immunity is not appropriate.” Lee, 284 F.3d at 1194. “To overcome a qualified immunity defense, the plaintiff must make two showings.” Corbitt v. Vickers, 929 F.3d 1304, 1311 (11th Cir. 2019). First, “the plaintiff must establish that the defendant violated a constitutional right.” Griffin Indus., Inc. v. Irvin, 496 F.3d 1189, 1199 (11th Cir. 2007). Second, “the plaintiff must show that the violation was clearly established.” Ibid. Courts are “permitted to exercise their sound discretion in deciding which of the two prongs of the qualified immunity analysis should be addressed first.” Corbitt, 929 F.3d at 1311 (quoting Pearson, 555 U.S. at 236).

We’ll start with this second prong because Christmas somehow never argues that Sheriff Jolley violated any law that was “clearly established.” 4 She’s thus forfeited any such argument—

4 Christmas dedicates just two sentences to this all-important issue. She says:

The rights violated in this case were no less clearly established than the rights violated against Nicholas Dyksma. While one would expect a Sheriff to recognize what the courts consider “clearly established” law and take appropriate action to prevent future violations following Dyksma’s death, that is not what happened here.

which is reason enough to affirm the district court’s qualified-im- munity finding. See United States v. Campbell, 26 F.4th 860, 873 (11th Cir. 2022) (“[F]ailure to raise an issue in an initial brief . . . should be treated as a forfeiture of the issue, and therefore the issue may be raised by the court sua sponte [only] in extraordinary circumstances[.]”); see also Irvin, 496 F.3d at 1200 (“If the official did not violate the law, the inquiry ends. If, however, the official violated the law[,] but his conduct was not clearly established as unlawful, the court must grant him qualified immunity. Only when the official violated the law and the illegality of his conduct was clearly established must the court deny him the protection of qualified immunity.” (cleaned up)).

Christmas also fails the first prong because she cannot show that, in the course of supervising Pierson, Sheriff Jolley violated her constitutional rights. “It is well established in this Circuit that supervisory officials are not liable under § 1983 for the unconstitutional acts of their subordinates on the basis of respondeat superior

But this “passing reference to an issue in a brief is not enough, and the failure to make arguments and cite authorities in support of an issue waives it.” Hamilton v. Southland Christian Sch., Inc., 680 F.3d 1316, 1319 (11th Cir. 2012). Christmas’s only other reference to “clearly established law” was her contention that, under “clearly established law, a “law enforcement officer[ ] may not detain a citizen for the illegitimate purpose of sexually harassing or assaulting [them].” That’s true. But Sheriff Jolley isn’t the law-enforcement officer who assaulted her; that was Pierson. And, as we explain in more detail above the line, “[s]upervisory officials are not vicarious liable under section 1983 for the unconstitutional acts of their subordinates.” Ingram v. Kubik, 30 F.4th 1241, 1254 (11th Cir. 2022).

or vicarious liability.” Cottone v. Jenne, 326 F.3d 1352, 1360 (11th Cir. 2003) (quoting Hartley v. Parnell, 193 F.3d 1263, 1269 (11th Cir. 1999)). “Instead, supervisory liability under § 1983 occurs either when the supervisor personally participates in the alleged unconstitutional conduct or when there is a causal connection between the actions of a supervising official and the alleged constitutional deprivation.” Ibid. (citing Gonzalez v. Reno, 325 F.3d 1228, 1234–35 (11th Cir. 2003), and then Brown v. Crawford, 906 F.2d 667, 671 (11th Cir. 1990)). Sheriff Jolley—it’s undisputed—didn’t participate in Pierson’s assault against Christmas, so Christmas can prevail only if she’s identified some other causal connection between the Sheriff’s actions and Pierson’s conduct.

“The necessary causal connection can be established when a history of widespread abuse puts the responsible supervisor on notice of the need to correct the alleged deprivation, and he fails to do so.” Ibid. (cleaned up). “Alternatively, the causal connection may be established when a supervisor’s custom or policy . . . result[s] in deliberate indifference to constitutional rights or when facts support an inference that the supervisor directed the subordinates to act unlawfully or knew that the subordinates would act unlawfully and failed to stop them from doing so.” Ibid. (cleaned up). “Under certain circumstances,” too, “a law enforcement agency’s failure to adequately train its officers may constitute a ‘policy’ giving rise to governmental liability.” Rivas v. Freeman, 940 F.2d 1491, 1495 (11th Cir. 1991) (citing Canton v. Harris, 489 U.S. 378 (1989)). Ultimately, though, “[t]he standard by which a supervisor is held liable in her individual capacity for the actions of a subordinate is extremely rigorous.” Braddy v. Fla. Dep’t of Labor & Emp’t. Sec., 133 F.3d 797, 802 (11th Cir. 1998).

Christmas fails each of these tests. For starters, she never argues that Pierson engaged in a history of widespread abuse such that Jolley would’ve been on notice of the need to take corrective action. Nor could she have. “The deprivations that constitute widespread abuse sufficient to notify the supervising official must be obvious, flagrant, rampant and of continued duration, rather than isolated occurrences.” Keith v. DeKalb Cnty., 749 F.3d 1034, 1048 (11th Cir. 2014) (cleaned up); see also Clark v. Evans, 840 F.2d 876, 885 (11th Cir. 1988) (holding that four instances in four years of a prison’s disregard of state-court committal orders was “insufficient to put [the prison’s commissioner] on notice, especially since the record [was] clear that such matters were handled at lower administrative levels and would not have come to [his] attention”). And isolated occurrences are all we have in this case.

Again, before Christmas’s assault, Sheriff Jolley was aware of two—and only two—instances of potential concern involving Pierson. In one, Pierson was sued for using excessive force against a young man who later died in police custody. In the other, Pierson’s ex-wife alleged that Pierson was following her in his police cruiser. These incidents may well have rendered Pierson unfit to serve as a police officer (and they may have warranted other action too). But, without for a moment condoning Pierson’s conduct (there or here),5 we can’t help but observe that neither incident involved a sexual assault, and that (as a result) neither would have put Sheriff Jolley on notice of Pierson’s proclivity for sexually assaulting people in his custody.

One more thing on the Dyksma incident: Pierson’s actions in that case occurred in the context of what started out as an arrest. To borrow a phrase from the law of qualified immunity, that incident thus (arguably) arose from Pierson’s discretionary duties as a police officer. That, of course, isn’t true of Pierson’s actions here— viz., activating his lights to force Christmas onto a side road and, once there, sexually assaulting her—which couldn’t (even arguably) be said to have anything to do with police conduct. So, while Sheriff Jolley might have had notice that Pierson could be overly aggressive in carrying out his law-enforcement duties, he had no notice that Pierson would engage in the kinds of ultra vires behavior Christmas has highlighted here.

The point, in any event, is this: Because these two incidents are of such a different character from the constitutional violation at hand, we simply cannot (consistent with our precedents) say that, based on them, Sheriff Jolley should (or could) have predicted Christmas’s assault. And so, we cannot conclude that Sheriff Jolley “failed to stop” Pierson from sexually assaulting Christmas. Mercado v. City of Orlando, 407 F.3d 1152, 1158 (11th Cir. 2005)

5 (or Jolley’s in apparently taking no remedial action with respect to these incidents).

(cleaned up). There’s also no indication in the record that Sheriff Jolley “directed [Pierson] to act unlawfully.” Ibid. On the contrary, Sheriff Jolley—it’s uncontested—didn’t hear about Pierson’s sexual misconduct until after Christmas was assaulted.

Nor has Christmas pointed to any “custom or policy [that] resulted in deliberate indifference to constitutional rights[.]” Gonzalez, 325 F.3d at 1234. “A policy is a decision that is officially adopted by the municipality, or created by an official of such rank that he or she could be said to be acting on behalf of the municipality.” Sewell v. Town of Lake Hamilton, 117 F.3d 488, 489 (11th Cir. 1997) (citing Brown v. City of Fort Lauderdale, 923 F.2d 1474, 1479–80 (11th Cir. 1991)). “A custom is an unwritten practice that is applied consistently enough to have the same effect as a policy with the force of law.” Goebert v. Lee Cnty., 510 F.3d 1312, 1332 (11th Cir. 2007) (citing City of St. Louis v. Praprotnik, 485 U.S. 112, 127 (1988)). “Demonstrating a policy or custom requires showing a persistent and wide-spread practice.” Ibid. (cleaned up). The unconstitutional act, moreover, must have been carried out “pursuant to” the alleged policy or custom. See Henley v. Payne, 945 F.3d 1320, 1331 (11th Cir. 2019) (“Mr. Henley’s § 1983 claim against Sheriff Millsap fails because he has not alleged that Deputy Payne carried out the purportedly unconstitutional arrest pursuant to a policy or custom of the Bartow County Sheriff’s Office.”).

Christmas identifies three “policies”—all allegedly implemented by Sheriff Jolley—that (she says) led to her assault: (1) the “policy” of considering only “formal, written complaints”; (2) the “policy” of “disregard[ing]” Pierson’s ex-wife’s stalking complaint; and (3) the “policy” of “not reporting” complaints of sexual misconduct. But these aren’t policies at all. They’re not, that is, “decision[s] that [are] officially adopted by the municipality, or created by an official of such rank that he or she could be said to be acting on behalf of the municipality.” Sewell, 117 F.3d at 489. They are, at best, customs of the police department, because (Christmas alleges) they’re “unwritten practice[s]” that are “applied consistently enough to have the same effect as a policy with the force of law.” Goebert, 510 F.3d at 1332.

This semantic clarification aside, for two reasons, Christmas’s three “customs” cannot save her claims. First, the undisputed record evidence conclusively undermines Christmas’s view that Sheriff Jolley ever adopted these customs as “unwritten practice[s]” of the department. Starting with the first such custom—the unwill- ingness to act on oral complaints—the record is clear that, with respect to two of the incidents in question here (Pierson’s ex-wife’s report that Pierson was following her and Christmas’s own assault accusation), Sheriff Jolley did investigate oral complaints. Recall that Pierson’s ex-wife had called Jolley to report her misgivings about Pierson, and that Jolley had responded to this call by directing his chief deputy to investigate the allegation—this, despite the absence of a written report. Remember, too, that Jolley only learned about Christmas’s report when officers of a different police department—the Pike County Sheriff’s Office—had called to alert him to Christmas’s allegations about Pierson. Again, it’s undisputed that, based on this call, Sheriff Jolley investigated the accusation and, the next day, fired Pierson.

The second “custom”—Sheriff Jolley’s alleged disregard of Pierson’s ex-wife’s call—fares no better. For one thing, it represents no custom at all; at best, it was the failure to act on a single report. For another, as we’ve seen, Sheriff Jolley did act on it—by directing his chief deputy to investigate the claim.

The third custom—of not reporting complaints of sexual misconduct—finds absolutely no support in the record. Sheriff Jolley—quite to the contrary—has proved himself rather willing to investigate, and to act on, sexual-misconduct allegations. When he learned of Christmas’s accusation, for instance, he immediately investigated her claim and, the next day, fired Pierson. Not content to let things lie there, though, he then engaged the GBI and sent a letter to every person Pierson had stopped over the previous six months. When more women came forward—including C.T. and L.F.—the GBI began collecting the evidence the government would later use to prosecute Pierson in criminal court. Sheriff Jolley even—on a prior occasion—fired a deputy for engaging in a consensual sexual relationship with a woman the deputy had met on duty. On these facts, in short, we have no evidence of any custom or policy to disregard complaints of sexual misconduct.

Second—and no less problematically—Christmas never explains how any of these customs might have “actually caused” her injuries. Cf. Gold v. City of Miami, 151 F.3d 1346, 1350 (11th Cir. 1998) (explaining, in the context of municipal liability, that a policy must be the “moving force” behind the constitutional violation); see also Goodman v. Kimbrough, 718 F.3d 1325, 1335–36 (11th Cir. 2013) (affirming the dismissal of a supervisory-liability claim against a sheriff where the complaint was “bereft of any allegation that [the] policy or custom actually caused [the plaintiff’s] injuries”).

Finally, Christmas cannot show that Sheriff Jolley failed to train Pierson. “Where the proper response . . . is obvious to all without training or supervision, then the failure to train or supervise is generally not so likely to produce a wrong decision as to support an inference of deliberate indifference by city policymakers to the need to train or supervise.” Sewell, 117 F.3d at 490 (cleaned up). That’s just the situation we have here: That a police officer should not (and may not) sexually assault citizens in his custody is “obvious to all without training or supervision.” Ibid.; see also McGuire v. Cooper, 952 F.3d 918, 923 (8th Cir. 2020) (“[T]here is no patently obvious need to train officers not to sexually assault women, nor is there a patently obvious need to train officers that[,] if they sexually assault a woman, they may be charged with a felony.”).

For all these reasons, then, Christmas doesn’t meet the “extremely rigorous” standard “by which a supervisor is held liable in his individual capacity for the actions of a subordinate[.]” Cottone, 326 F.3d at 1360 (cleaned up). As a result, she’s failed to show “that [Sheriff Jolley] violated a constitutional right.” Irvin, 496 F.3d at 1199.

IV. CONCLUSION

We roundly condemn Pierson’s unacceptable (and frankly criminal) conduct towards Christmas and others. But, because Sheriff Jolley had nothing to do with that misconduct—and because the Sheriff had no notice of Pierson’s tendency to sexually assault civilians in his custody—he cannot be held responsible for the unpredictable acts of his subordinate. After careful review, we AFFIRM the district court’s order granting summary judgment to Sheriff Jolley.

AFFIRMED.