diff --git a/s3/src/main/resources/reference.conf b/s3/src/main/resources/reference.conf
index c095d11ed..7045c80ed 100644
--- a/s3/src/main/resources/reference.conf
+++ b/s3/src/main/resources/reference.conf
@@ -27,7 +27,10 @@ pekko.connectors.s3 {
       #
       # provider = anon
 
-      # static credentials
+      # static credentials — avoid in production; prefer environment variables,
+      # IAM roles, or the default provider chain instead.
+      # Embedding secrets in config files risks accidental exposure via version
+      # control, logs, or process listings.
       #
       # provider = static
       # access-key-id = ""