diff --git a/doc/bugs/git_annex_connecting_over_tor_does_not_work/comment_1_35c33ae1d69382a03c94f4a20ec22f7e._comment b/doc/bugs/git_annex_connecting_over_tor_does_not_work/comment_1_35c33ae1d69382a03c94f4a20ec22f7e._comment
index 53efebbf49..289688d5bb 100644
--- a/doc/bugs/git_annex_connecting_over_tor_does_not_work/comment_1_35c33ae1d69382a03c94f4a20ec22f7e._comment
+++ b/doc/bugs/git_annex_connecting_over_tor_does_not_work/comment_1_35c33ae1d69382a03c94f4a20ec22f7e._comment
@@ -10,4 +10,8 @@ I can reproduce this by running eg:
 	joey@darkstar:~/tmp/torrepo>su -c "git-annex --debug enable-tor 1000"
 	Password:
 	git-annex: This can only be run in a git-annex repository.
+
+This was broken by git's security fix for CVE-2022-24765. Now when the root
+process tries to run `git config --list`, git does not display the local
+.git/config, because it is owned by another user.
 """]]
diff --git a/doc/bugs/git_annex_connecting_over_tor_does_not_work/comment_2_5df90e5ffbd3f089a0f640d4a5b85a1c._comment b/doc/bugs/git_annex_connecting_over_tor_does_not_work/comment_2_5df90e5ffbd3f089a0f640d4a5b85a1c._comment
new file mode 100644
index 0000000000..6261bfc7f2
--- /dev/null
+++ b/doc/bugs/git_annex_connecting_over_tor_does_not_work/comment_2_5df90e5ffbd3f089a0f640d4a5b85a1c._comment
@@ -0,0 +1,8 @@
+[[!comment format=mdwn
+ username="joey"
+ subject="""comment 2"""
+ date="2022-09-26T17:24:23Z"
+ content="""
+Note that when git-annex uses sudo to gain root, git does not behave that
+way. But it can also use su or other methods.
+"""]]