diff --git a/docs/dwo-configuration.md b/docs/dwo-configuration.md
index 6cf9da81e..6dec3787b 100644
--- a/docs/dwo-configuration.md
+++ b/docs/dwo-configuration.md
@@ -125,7 +125,10 @@ Backup CronJob configuration fields:
 The value provided for registry.path is only the first segment of the final location. The full registry path is assembled dynamically, incorporating the name of the workspace and the :latest tag, following this pattern:
 `<registry.path>/<devworkspace-name>:latest`
 
-- **`registry.authSecret`**: (Optional) The name of the Kubernetes Secret containing credentials to access the OCI registry. If not provided, it is assumed that the registry is public or uses integrated OpenShift registry.
+- **`registry.authSecret`**: (Optional) The name of the Kubernetes Secret containing credentials to access the OCI registry. If not provided, it is assumed that the registry is public or uses integrated OpenShift registry. 
+
+**Note**: This Secret **must** be labeled with `controller.devfile.io/watch-secret=true` in order for the DevWorkspace Operator to recognize and use it.
+ 
 - **`oras.extraArgs`**: (Optional) Additional arguments to pass to the `oras` CLI tool during push and pull operations.