diff --git a/docs/development.md b/docs/development.md
index b4e1dcd..9001215 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -108,4 +108,11 @@ The two backend instances are set up to use the domains `a.localhost` and `b.loc
 server is used to direct the frontend to the correct backend instance.
 The frontend is configured to act as if it was served from the domain `a.localhost`.
 Access the frontend at `http://localhost:8080/`, backend at `http://localhost:8080/api/`, api docs
-at `http://localhost:8080/docs/` and the wiki at `http://localhost:8080/wiki/`.
\ No newline at end of file
+at `http://localhost:8080/docs/` and the wiki at `http://localhost:8080/wiki/`.
+
+The dev proxies terminate TLS with `frontend/.local/localhost.crt`, signed by the dev-only CA at
+`frontend/.local/RootCA.crt` (regenerate both with `frontend/.local/make_ca.sh` and
+`make_localhost.sh` if they've expired). Import `RootCA.crt` into your OS/browser trust store once;
+without that, requests the frontend makes itself (federation calls, the DoH lookup) will fail with
+opaque network errors even though clicking through the browser's own cert warning for the page you
+navigated to by hand looked fine.
\ No newline at end of file