diff --git a/docs/installation/index.md b/docs/installation/index.md
index 1905448cd..467b82bad 100644
--- a/docs/installation/index.md
+++ b/docs/installation/index.md
@@ -66,6 +66,10 @@ For OIDC login (overrides password login):
 - `HOMEPAGE_OIDC_CLIENT_SECRET`
 - Optional: `HOMEPAGE_OIDC_NAME` (display name), `HOMEPAGE_OIDC_SCOPE` (defaults to `openid email profile`)
 
+!!! warning
+
+    Homepage grants access to any identity that the configured OIDC provider authorizes for this client. Configure client assignments, groups, or access policies at the identity provider. Homepage does not apply additional claim-based authorization.
+
 All app pages and `/api` routes except `/api/healthcheck` will require a signed-in session. Static assets remain public.
 
 Configure your OIDC provider with the a callback URI like `https://homepage.example.com/api/auth/callback/homepage-oidc`.