diff --git a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/MqttClientOptionsFactory.cs b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/MqttClientOptionsFactory.cs
index 8b0dcd69..0f7e4333 100644
--- a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/MqttClientOptionsFactory.cs
+++ b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/MqttClientOptionsFactory.cs
@@ -119,6 +119,21 @@ public static class MqttClientOptionsFactory
 
         if (options.AllowUntrustedServerCertificate)
         {
+            // A configured CA pin is DEAD in this branch — every certificate is accepted, pinned chain
+            // or not. Silence here reads to an operator as "the pin is in force", which is the one
+            // belief this combination must never leave them holding: the pin is what they set to make a
+            // MITM fail closed, and the escape hatch is what makes it fail open. Warn, do not
+            // second-guess — the explicit flag stays authoritative, so a deployment that genuinely wants
+            // the hatch keeps working and merely says so in its log.
+            if (!string.IsNullOrWhiteSpace(options.CaCertificatePath))
+            {
+                logger?.LogWarning(
+                    "MQTT: allowUntrustedServerCertificate is on, so the pinned CA '{CaCertificatePath}' is NOT "
+                    + "being enforced — ANY broker certificate is accepted. Clear the flag to make the pin "
+                    + "effective.",
+                    options.CaCertificatePath);
+            }
+
             // Dev / on-prem escape hatch, off unless explicitly enabled — mirrors the
             // ServerHistorian TLS knobs. This is the ONLY branch that accepts a bad certificate.
             tls.WithAllowUntrustedCertificates(true)