diff --git a/docs/setup.md b/docs/setup.md
index 76235dbd..8e333d5f 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -54,6 +54,10 @@ surfaces (the swarm UI below) are gated on that group, and an account
 without it authenticates successfully and is then refused — which reads
 like a broken login rather than a missing group.
 
+If an account already exists without it, `user add` will refuse rather
+than amend — adding the group afterwards is `swarmctl user update mara
+--add-group admins`.
+
 Detail, including what the password is and why this stays manual:
 [`swarm/sso.md`](swarm/sso.md).