diff --git a/docs/Configuration/configuration-files/README.md b/docs/Configuration/configuration-files/README.md
index e9c1ac7bcb..3824fdd68e 100644
--- a/docs/Configuration/configuration-files/README.md
+++ b/docs/Configuration/configuration-files/README.md
@@ -264,7 +264,7 @@ spec:
 
 ### Team secrets
 
-The `secrets` section provides the list of enroll secrets that will be valid for this team. If the section is missing, the existing secrets are left unmodified. Otherwise, they are replaced with this list of secrets for this team.
+The `secrets` section provides the list of enroll secrets that will be valid for this team. When a new team is created via `fleetctl apply`, an enroll secret is automatically generated for it. If the section is missing, the existing secrets are left unmodified. Otherwise, they are replaced with this list of secrets for this team.
 
 - Optional setting (array of dictionaries)
 - Default value: none (empty)
@@ -1118,4 +1118,4 @@ If you're using Fleet Premium, this enforces disk encryption on all hosts assign
 > **Note:** More settings are included in the [contributor documentation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Configuration-for-contributors.md). It's possible, although not recommended, to configure these settings in the YAML configuration file.
 
 <meta name="description" value="Learn how to use configuration files and the fleetctl command line tool to configure Fleet.">
-<meta name="navSection" value="Fleet server">
\ No newline at end of file
+<meta name="navSection" value="Fleet server">