diff --git a/clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs b/clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs
index 9429ef9..a345908 100644
--- a/clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs
+++ b/clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs
@@ -353,11 +353,16 @@ public static class MxGatewayClientCli
     /// </summary>
     private const string DefaultVerifyPasswordEnvironmentName = "MXGATEWAY_VERIFY_PASSWORD";
 
+    /// <summary>
+    ///     Default environment variable holding the operator password for
+    ///     <c>acknowledge-alarm</c> when <c>--operator-password-env</c> is not given.
+    /// </summary>
+    private const string OperatorPasswordEnvironmentName = "MXGATEWAY_OPERATOR_PASSWORD";
+
     /// <summary>
     ///     Legacy environment variable, still honoured as a deprecated fallback
     ///     for one release so existing scripts keep working.
     /// </summary>
-    private const string OperatorPasswordEnvironmentName = "MXGATEWAY_OPERATOR_PASSWORD";
     private const string LegacyVerifyPasswordEnvironmentName = "MXGATEWAY_VERIFY_USER_PASSWORD";
 
     /// <summary>
@@ -381,14 +386,10 @@ public static class MxGatewayClientCli
     }
 
     /// <summary>
-    ///     Resolves the effective MXAccess verify-user credential in this
-    ///     order: <c>--password</c>, the deprecated <c>--verify-user-password</c>
-    ///     alias, the environment variable named by <c>--password-env</c> (default
-    ///     <c>MXGATEWAY_VERIFY_PASSWORD</c>), then the deprecated
-    ///     <c>MXGATEWAY_VERIFY_USER_PASSWORD</c>. An empty value from any source is
-    ///     treated as absent. The credential is never echoed; this resolver exists so
-    ///     the error-redaction catch block can strip it from any surfaced error,
-    ///     mirroring <see cref="TryResolveApiKey" />.
+    ///     Resolves the <c>acknowledge-alarm</c> operator password: <c>--operator-password</c>,
+    ///     then the environment variable named by <c>--operator-password-env</c>
+    ///     (default <c>MXGATEWAY_OPERATOR_PASSWORD</c>). An empty value is treated as
+    ///     absent. The value is never echoed; it is also fed to the error redactor.
     /// </summary>
     private static string? ResolveOperatorPassword(CliArguments arguments)
     {
@@ -408,6 +409,16 @@ public static class MxGatewayClientCli
         return string.IsNullOrEmpty(password) ? null : password;
     }
 
+    /// <summary>
+    ///     Resolves the effective MXAccess verify-user credential in this
+    ///     order: <c>--password</c>, the deprecated <c>--verify-user-password</c>
+    ///     alias, the environment variable named by <c>--password-env</c> (default
+    ///     <c>MXGATEWAY_VERIFY_PASSWORD</c>), then the deprecated
+    ///     <c>MXGATEWAY_VERIFY_USER_PASSWORD</c>. An empty value from any source is
+    ///     treated as absent. The credential is never echoed; this resolver exists so
+    ///     the error-redaction catch block can strip it from any surfaced error,
+    ///     mirroring <see cref="TryResolveApiKey" />.
+    /// </summary>
     private static string? TryResolveVerifyUserPassword(CliArguments arguments)
     {
         string? password = arguments.GetOptional("password");