diff --git a/doc/git-annex-shell.mdwn b/doc/git-annex-shell.mdwn
index c6e8c05c0a..eafb164682 100644
--- a/doc/git-annex-shell.mdwn
+++ b/doc/git-annex-shell.mdwn
@@ -106,6 +106,9 @@ changed.
 
   If set, disallows any command that could modify the repository.
 
+  Note that this does not prevent passing commands on to git-shell.
+  For that, you also need ...
+
 * GIT_ANNEX_SHELL_LIMITED
 
   If set, disallows running git-shell to handle unknown commands.