diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml
index 6224b5955..55f19c0d9 100644
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -65,8 +65,9 @@ cozystackOperator:
   platformSourceSecret: ''
   # Name of the Secret in cozy-system namespace with TLS material for an OCI
   # platform source: `ca.crt` for a registry whose certificate is issued by a
-  # private CA, and/or `tls.crt`+`tls.key` for client certificate auth (type
-  # Opaque or kubernetes.io/tls). When non-empty, sets spec.certSecretRef on the
+  # private CA, and/or `tls.crt`+`tls.key` for client certificate auth. A
+  # CA-only Secret must be type Opaque: kubernetes.io/tls requires `tls.crt`
+  # and `tls.key`. When non-empty, sets spec.certSecretRef on the
   # generated OCIRepository; the operator rewrites that object on every start,
   # so a certSecretRef patched onto it by hand does not survive a restart.
   # The cozystack-packages source copies the spec, so it inherits the CA too.