diff --git a/docs/radius/dot1x.md b/docs/radius/dot1x.md
index 28c73bfe..4fa828a6 100644
--- a/docs/radius/dot1x.md
+++ b/docs/radius/dot1x.md
@@ -162,10 +162,11 @@ WLANs that advertise Hotspot 2.0 with domain and NAI realm `renner.uno`
 (EAP-TTLS/PAP).
 
 App password lifetimes are capped by the group attribute
-`goauthentik.io/user/token-maximum-lifetime` (default: the token default of
-30 minutes). WLAN users need a group with
-`goauthentik.io/user/token-maximum-lifetime: days=3650`, or the creation fails
-(502 on the callback, reason in the wlan-setup log).
+`goauthentik.io/user/token-maximum-lifetime` (without it: 30 days). WLAN users
+need a group with `goauthentik.io/user/token-maximum-lifetime: days=3650`, or
+the creation fails with `Token expires exceeds maximum lifetime` (502 on the
+callback, reason in the wlan-setup log). Creating the app password needs no
+admin rights.
 
 All clients use EAP-TTLS with inner PAP. The server certificate is a public
 Let's Encrypt certificate for `radius.renner.uno`, so no CA needs to be