diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ApiKeys.razor b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ApiKeys.razor
index e96e0b8a..8fc31a67 100644
--- a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ApiKeys.razor
+++ b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ApiKeys.razor
@@ -15,8 +15,11 @@
     whose password is the key below. The key resolves to a <strong>principal</strong>; ACL rows naming
     that principal are what grant it permissions.
     <br />
-    <strong>Revoking a key takes effect on a node only after the next deployment</strong> — driver-only
-    nodes have no config database, so keys travel inside the deployment artifact.
+    <strong>Revocation is not uniform across the fleet.</strong> A node with a config database (a fused
+    admin+driver node such as this one) applies it <em>immediately</em>, because it reads keys per
+    request. A <strong>driver-only</strong> node has no config database, so its keys travel inside the
+    deployment artifact and a revocation reaches it only on the <strong>next deployment</strong>.
+    Assume the slower behaviour when revoking a compromised key.
 </div>
 
 @if (_created is not null)