diff --git a/k8s/staging/cms-deployment.yaml b/k8s/staging/cms-deployment.yaml
index b5797a4..f54219b 100644
--- a/k8s/staging/cms-deployment.yaml
+++ b/k8s/staging/cms-deployment.yaml
@@ -101,6 +101,8 @@ spec:
 
 ---
 # CMS Ingress
+# If clients report TLS PartialChain, the tls secret (cms-tls) tls.crt must include the full chain
+# (leaf + intermediates). cert-manager ACME usually provides this; manual certs need fullchain.pem in tls.crt.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata: