diff --git a/man/nss-systemd.xml b/man/nss-systemd.xml
index ff4416c258..ddadef01f5 100644
--- a/man/nss-systemd.xml
+++ b/man/nss-systemd.xml
@@ -108,6 +108,12 @@ lrwxrwxrwx. 1 root root   19 May 10 4711.user-privileged -> foobar.user-privileg
     <filename>/etc/passwd</filename> or <filename>/etc/group</filename> or other account databases. In fact,
     before dropping in these files a reasonable level of care should be taken to avoid user/group name and
     UID/GID conflicts.</para>
+
+    <para>The <filename>systemd-userdb-load-credentials.service</filename> service automatically runs at boot
+    and installs these files from user records passed in via system credentials. See
+    <citerefentry><refentrytitle>userdbctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> and
+    <citerefentry><refentrytitle>systemd.system-credentials</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+    for details.</para>
   </refsect1>
 
   <refsect1>
@@ -186,6 +192,8 @@ vu-rawhide-1000  1637 pts/8    -zsh
       <member><citerefentry><refentrytitle>systemd-userdbd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-homed.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>userdbctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd.system-credentials</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
       <member><citerefentry project='man-pages'><refentrytitle>nsswitch.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
       <member><citerefentry project='man-pages'><refentrytitle>getent</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
     </simplelist></para>
diff --git a/man/userdbctl.xml b/man/userdbctl.xml
index 77d0b1ffaa..194f8e0e6f 100644
--- a/man/userdbctl.xml
+++ b/man/userdbctl.xml
@@ -42,7 +42,9 @@
     url="https://systemd.io/USER_GROUP_API">User/Group Record Lookup API via Varlink</ulink>, and may also
     pick up drop-in JSON user and group records from <filename>/etc/userdb/</filename>,
     <filename>/run/userdb/</filename>, <filename>/run/host/userdb/</filename>,
-    <filename>/usr/lib/userdb/</filename>.</para>
+    <filename>/usr/lib/userdb/</filename> (see
+    <citerefentry><refentrytitle>nss-systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry> for
+    details about drop-in user records).</para>
   </refsect1>
 
   <refsect1>
@@ -343,16 +345,15 @@
               <term><varname>userdb.user.*</varname></term>
               <term><varname>userdb.group.*</varname></term>
               <listitem>
-                <para>These credentials should contain valid
-                <ulink url="https://systemd.io/USER_RECORD">JSON User</ulink> and
-                <ulink url="https://systemd.io/GROUP_RECORD">JSON Group</ulink> records. For each matching
-                credential, various files are created in <filename>/etc/userdb/</filename>, implementing the
-                interface described in
+                <para>These credentials should contain valid <ulink url="https://systemd.io/USER_RECORD">JSON
+                User</ulink> and <ulink url="https://systemd.io/GROUP_RECORD">JSON Group</ulink> records. For
+                each matching credential, various files are created in <filename>/etc/userdb/</filename>,
+                implementing the interface described in
                 <citerefentry><refentrytitle>nss-systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
-                Any passed user records must contain uid and gid fields. Any passed group records must
-                contain a gid field. For both user and group records, the credential suffix (for
-                <literal>userdb.user.foobar</literal> the suffix is <literal>foobar</literal>) must match the
-                user or group name encoded in the record.</para>
+                Any passed user records must contain valid UID and GID fields. Any passed group records must
+                contain a GID field (i.e. automatic UID/GID allocation is not supported). For both user and
+                group records, the credential suffix (for <literal>userdb.user.foobar</literal> the suffix is
+                <literal>foobar</literal>) must match the user or group name encoded in the record.</para>
 
                 <xi:include href="version-info.xml" xpointer="v258"/>
               </listitem>