diff --git a/content/en/docs/private-platform/secret-management/pmp-key-vault-integration.md b/content/en/docs/private-platform/secret-management/pmp-key-vault-integration.md
index 5ff9f28fe90..29e617d0c57 100644
--- a/content/en/docs/private-platform/secret-management/pmp-key-vault-integration.md
+++ b/content/en/docs/private-platform/secret-management/pmp-key-vault-integration.md
@@ -59,6 +59,47 @@ Verify the configuration by using the following command:
 kubectl auth can-i create secretproviderclasses --as=system:serviceaccount:kube-system:mxplatform-cicd -n <namespace>
 ```
 
+#### Example Manifest
+
+The following manifest is an example showing how to create roles and role bindings for each namespace where you wish to deploy apps using the automatic Key Vault feature.
+
+{{% alert color="warning" %}}
+The examples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios.
+{{% /alert %}}
+
+```text
+Key Vault permissions for app namespace ns-apps-1 (Role + RoleBinding pointing to mxplatform-cicd SA)
+NS=ns-apps-1
+kubectl apply -f - <<EOF
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pmp-secret-management
+  namespace: ${NS}
+rules:
+- apiGroups: ["secrets-store.csi.x-k8s.io"]
+  resources: ["secretproviderclasses"]
+  verbs: ["get","create","patch","delete"]
+- apiGroups: [""]
+  resources: ["serviceaccounts"]
+  verbs: ["get","create","patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pmp-secret-management-binding
+  namespace: ${NS}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pmp-secret-management
+subjects:
+- kind: ServiceAccount
+  name: mxplatform-cicd
+  namespace: kube-system
+EOF
+```
+
 ## Known Limitations
 
 The following limitations apply:
diff --git a/content/en/docs/releasenotes/private-platform/2/2.8.md b/content/en/docs/releasenotes/private-platform/2/2.8.md
index 56bf9aa4319..dc9ab307365 100644
--- a/content/en/docs/releasenotes/private-platform/2/2.8.md
+++ b/content/en/docs/releasenotes/private-platform/2/2.8.md
@@ -167,6 +167,10 @@ kubectl get mendixapp mxplatform -n pmp-oci-test -o yaml |
 kubectl apply --server-side --force-conflicts --field-manager='helm' -f
 ```
 
+##### Custom HTTP Headers Limitation
+
+In the current release of Private Mendix Platform, you cannot add custom HTTP headers through custom runtime settings.
+
 ## 2.8.0
 
 ### Release date: August 19, 2026