diff --git a/envoy/api/v2/core/config_source.proto b/envoy/api/v2/core/config_source.proto
index f32a39e6..2b1a6a7c 100644
--- a/envoy/api/v2/core/config_source.proto
+++ b/envoy/api/v2/core/config_source.proto
@@ -135,6 +135,8 @@ message ConfigSource {
     option (validate.required) = true;
 
     // Path on the filesystem to source and watch for configuration updates.
+    // When sourcing configuration for :ref:`secret <envoy_api_msg_auth.Secret>`,
+    // the certificate and key files are also watched for updates.
     //
     // .. note::
     //
diff --git a/envoy/config/core/v3/config_source.proto b/envoy/config/core/v3/config_source.proto
index 2ec7b5b2..e45812c2 100644
--- a/envoy/config/core/v3/config_source.proto
+++ b/envoy/config/core/v3/config_source.proto
@@ -144,6 +144,8 @@ message ConfigSource {
     option (validate.required) = true;
 
     // Path on the filesystem to source and watch for configuration updates.
+    // When sourcing configuration for :ref:`secret <envoy_api_msg_extensions.transport_sockets.tls.v3.Secret>`,
+    // the certificate and key files are also watched for updates.
     //
     // .. note::
     //