diff --git a/docs/swarm/sso.md b/docs/swarm/sso.md
index fe17e5b8..cb38d00a 100644
--- a/docs/swarm/sso.md
+++ b/docs/swarm/sso.md
@@ -242,11 +242,18 @@ page-only check. This was verified that way when the split was introduced.
 
 ## What this doesn't do
 
-- **It doesn't disable local login.** Each service keeps its password
-  database and gains a second door. An identity provider that can take a
-  service offline when it hiccups is worse than one with two ways in.
-  Making authelia the only path is a separate, reversible switch per
-  service (tuwunel's `login_with_password`, forgejo's own setting).
+- **It doesn't disable local login — except on Grafana.** Forgejo and
+  tuwunel keep their password databases and gain a second door: an identity
+  provider that can take a service offline when it hiccups is worse than one
+  with two ways in, and making authelia the only path there is a separate,
+  reversible switch (tuwunel's `login_with_password`, forgejo's own setting).
+  ⚠️ **Grafana is the exception, and not a reversible one.** Its module sets
+  `auth.disable_login_form` unconditionally, because Grafana ships an
+  `admin`/`admin` account and its vhost is on the public gateway — so a
+  password box there is a way in whatever the deployment. SSO is the only
+  door, and a dead provider locks everyone out, the built-in admin
+  included. That's why `swarm.grafana.oidc.role` defaults to `Admin`; see
+  [`services.md`](services.md#metrics-victoriametrics--grafana).
 - **It doesn't provision users.** Agents are created and destroyed
   continuously, so the subject set belongs to a program rather than to a
   config file; today that program is `swarmctl`.