diff --git a/website/source/docs/agent/configuration/vault.html.md b/website/source/docs/agent/configuration/vault.html.md
index a491d6348..9d1e012b2 100644
--- a/website/source/docs/agent/configuration/vault.html.md
+++ b/website/source/docs/agent/configuration/vault.html.md
@@ -51,7 +51,9 @@ vault {
   The token given to Nomad does not have to be created from this role but must
   have "update" capability on "auth/token/create/<create_from_role>" path in
   Vault. If this value is unset and the token is created from a role, the value
-  is defaulted to the role the token is from.
+  is defaulted to the role the token is from. This is largely for backwards
+  compatibility. It is recommended to set the `create_from_role` field if Nomad
+  is deriving child tokens from a role.
 
 - `task_token_ttl` `(string: "")` - Specifies the TTL of created tokens when
   using a root token. This is specified using a label suffix like "30s" or "1h".