diff --git a/apis/concierge/authentication/v1alpha1/types_tls.go.tmpl b/apis/concierge/authentication/v1alpha1/types_tls.go.tmpl
index ad2278985..cc823a05e 100644
--- a/apis/concierge/authentication/v1alpha1/types_tls.go.tmpl
+++ b/apis/concierge/authentication/v1alpha1/types_tls.go.tmpl
@@ -11,6 +11,7 @@ type CABundleSource struct {
 	// +kubebuilder:validation:Enum=Secret;ConfigMap
 	Kind string `json:"kind"`
 	// Name of the secret or configmap from which to read the CA bundle.
+	// The referenced secret or configmap must be created in the same namespace where Pinniped Concierge is installed.
 	// +kubebuilder:validation:MinLength=1
 	Name string `json:"name"`
 	// Key within the secret or configmap from which to read the CA bundle.
diff --git a/apis/supervisor/idp/v1alpha1/types_tls.go.tmpl b/apis/supervisor/idp/v1alpha1/types_tls.go.tmpl
index c0fc606f6..19d6d863a 100644
--- a/apis/supervisor/idp/v1alpha1/types_tls.go.tmpl
+++ b/apis/supervisor/idp/v1alpha1/types_tls.go.tmpl
@@ -12,6 +12,7 @@ type CABundleSource struct {
 	// +kubebuilder:validation:Enum=Secret;ConfigMap
 	Kind string `json:"kind"`
 	// Name of the secret or configmap from which to read the CA bundle.
+	// The referenced secret or configmap must be created in the same namespace where Pinniped Supervisor is installed.
 	// +kubebuilder:validation:MinLength=1
 	Name string `json:"name"`
 	// Key within the secret or configmap from which to read the CA bundle.