diff --git a/doc/source/user/config.rst b/doc/source/user/config.rst
index f55fb4fc4b..c4014e2bb0 100644
--- a/doc/source/user/config.rst
+++ b/doc/source/user/config.rst
@@ -952,12 +952,12 @@ Here is an example of two job definitions:
 
       A boolean value which indicates whether this job may only be
       used in pipelines where :attr:`pipeline.post-review` is
-      ``true``.  This is automatically set to ``true`` if this job is
-      defined in a :term:`untrusted-project`.  It may be explicitly
-      set to obtain the same behavior for jobs defined in
-      :term:`config projects <config-project>`.  Once this is set to
-      ``true`` anywhere in the inheritance hierarchy for a job, it
-      will remain set for all child jobs and variants (it can not be
+      ``true``.  This is automatically set to ``true`` if this job
+      uses a :ref:`secret` and is defined in a :term:`untrusted-project`.
+      It may be explicitly set to obtain the same behavior for jobs
+      defined in :term:`config projects <config-project>`.  Once this
+      is set to ``true`` anywhere in the inheritance hierarchy for a job,
+      it will remain set for all child jobs and variants (it can not be
       set to ``false``).
 
 .. _project: