diff --git a/Projects/UOContent/Accounting/Account.cs b/Projects/UOContent/Accounting/Account.cs
index 9c63a95a5..206099768 100644
--- a/Projects/UOContent/Accounting/Account.cs
+++ b/Projects/UOContent/Accounting/Account.cs
@@ -392,7 +392,8 @@ public partial class Account : IAccount, IComparable<Account>
     /// reported being locked out, and never on one that can still log in: the repair cannot tell a
     /// mis-migrated hash from a password that merely begins with the username, so marking a working
     /// account risks rewriting its credential down to whatever was submitted. Cleared automatically
-    /// once a repair succeeds.
+    /// once a repair succeeds. Necessary but not sufficient: the shard-wide
+    /// <see cref="AccountSecurity.RepairMigratedPasswords"/> switch must be on as well.
     /// </summary>
     public const string RepairPasswordTag = "RepairMigratedPassword";
 
diff --git a/Projects/UOContent/Accounting/Security/AccountSecurity.cs b/Projects/UOContent/Accounting/Security/AccountSecurity.cs
index c2c495c2f..a156f4a61 100644
--- a/Projects/UOContent/Accounting/Security/AccountSecurity.cs
+++ b/Projects/UOContent/Accounting/Security/AccountSecurity.cs
@@ -36,11 +36,17 @@ public static class AccountSecurity
     public static PasswordProtectionAlgorithm CurrentAlgorithm { get; set; }
 
     /// <summary>
-    /// Enables a one-time repair for accounts whose password was corrupted by the pre-fix
-    /// SetPassword, which hashed username + password but tagged it with an algorithm whose phrase
-    /// rule omits the username. Off by default: the repair costs a second verify on every FAILED
-    /// login, and failed logins are the credential-stuffing surface. Turn it on for a migration
-    /// window, then off again.
+    /// Shard-wide master switch for the one-time repair of accounts whose password was corrupted by
+    /// the pre-fix SetPassword, which stored the credential under the wrong family's phrase rule.
+    /// This flag alone repairs nothing: an account is only repaired when it *also* carries the
+    /// <see cref="Account.RepairPasswordTag"/> tag, which an operator adds from the admin gump
+    /// (Account Details -> Tags -> Add Tag) and which is cleared automatically once the repair
+    /// succeeds. Tag only an account whose owner has actually reported being locked out, never one
+    /// that can still log in: the repair cannot distinguish a mis-migrated hash from a password that
+    /// merely begins with the username, so tagging a working account risks rewriting its credential
+    /// down to whatever was submitted. Off by default because the repair costs a second verify on a
+    /// failed login -- for tagged accounts only, so the credential-stuffing surface is unaffected by
+    /// the flag on its own. Turn it on for a migration window, then off again.
     /// </summary>
     public static bool RepairMigratedPasswords { get; set; }