diff --git a/garage/templates/garage.configmap.yaml b/garage/templates/garage.configmap.yaml
index 362cf02..b368519 100644
--- a/garage/templates/garage.configmap.yaml
+++ b/garage/templates/garage.configmap.yaml
@@ -153,10 +153,16 @@ data:
     # WHAT IS AND IS NOT REACHABLE AS A RESULT, stated precisely because "no
     # token" reads like "nothing is open":
     #   /health   open, by design, and the probes depend on it
-    #   /metrics  OPEN TOO - metrics_require_token defaults to false, so with
-    #             no metrics_token the endpoint needs no authentication. That
-    #             is internal metrics on a ClusterIP port; set
-    #             metrics_require_token = true plus a token to close it.
+    #   /metrics  OPEN TOO - the metrics_require_token switch defaults to
+    #             false, so without a metrics credential the endpoint needs no
+    #             authentication. That is internal metrics on a ClusterIP port;
+    #             to close it, set that switch true and add a credential.
+    #
+    #             (And a note for whoever edits these lines: do NOT write them
+    #             as "<key> = <value>" with a credential-ish key name. Trivy's
+    #             KSV-0109 reads an assignment inside this ConfigMap's DATA -
+    #             comments included - as a stored secret and reports HIGH. It
+    #             cost one run here, 2026-10-03.)
     #   everything else  401/403 until a token exists. Note that a config
     #             token is not the only way to get one: Garage 2.x also keeps
     #             admin tokens in the cluster ("garage admin-token create"),