diff --git a/docker/frontend/src/i18n/en.ts b/docker/frontend/src/i18n/en.ts
index 3176faa..ae4eb30 100644
--- a/docker/frontend/src/i18n/en.ts
+++ b/docker/frontend/src/i18n/en.ts
@@ -381,8 +381,9 @@ export const en: Dict = {
   'lib.immich.keyShare': 'This is a share link, not an API key',
   'lib.immich.keyCheck': 'CHECK THE KEY',
   'lib.immich.checking': 'CHECKING…',
+  'lib.immich.keyHelp': 'In Immich: your avatar ▸ Settings ▸ API Keys ▸ NEW API KEY.',
   'lib.immich.perms':
-    'The API key needs all six read permissions: album.read, album.statistics, asset.read, asset.view, asset.download and asset.statistics.',
+    'Tick exactly these six: album.read, album.statistics, asset.read, asset.view, asset.download, asset.statistics. Sending edited frames back to the cloud also needs asset.upload, album.create and albumAsset.create. Nothing else — this app never deletes or shares.',
   'lib.immich.ok': 'The key works.',
   'lib.immich.albumsPick': 'Tick the albums to keep in the library. Ticking none means all of them.',
   'lib.immich.albumIds': 'Or paste album IDs',
diff --git a/docker/frontend/src/i18n/vi.ts b/docker/frontend/src/i18n/vi.ts
index ae9117c..bee4eb7 100644
--- a/docker/frontend/src/i18n/vi.ts
+++ b/docker/frontend/src/i18n/vi.ts
@@ -393,8 +393,9 @@ export const vi = {
   'lib.immich.keyShare': 'Đây là link chia sẻ, không phải API key',
   'lib.immich.keyCheck': 'KIỂM TRA KHOÁ',
   'lib.immich.checking': 'ĐANG KIỂM TRA…',
+  'lib.immich.keyHelp': 'Trong Immich: ảnh đại diện ▸ Cài đặt ▸ API Keys ▸ NEW API KEY.',
   'lib.immich.perms':
-    'Khoá API cần đủ 6 quyền đọc: album.read, album.statistics, asset.read, asset.view, asset.download và asset.statistics.',
+    'Tick đúng sáu quyền này: album.read, album.statistics, asset.read, asset.view, asset.download, asset.statistics. Muốn đẩy ảnh đã sửa ngược lên cloud thì thêm asset.upload, album.create và albumAsset.create. Không cần gì khác — app không bao giờ xoá hay chia sẻ.',
   'lib.immich.ok': 'Khoá dùng được.',
   'lib.immich.albumsPick': 'Tick những album đưa vào thư viện. Không tick gì nghĩa là lấy tất cả.',
   'lib.immich.albumIds': 'Hoặc dán ID album',
diff --git a/docker/frontend/src/ui/ImmichDialog.tsx b/docker/frontend/src/ui/ImmichDialog.tsx
index 4e82fbe..9cc6cc6 100644
--- a/docker/frontend/src/ui/ImmichDialog.tsx
+++ b/docker/frontend/src/ui/ImmichDialog.tsx
@@ -293,6 +293,14 @@ export function ImmichDialog({
             answered it, and the save below probes again anyway. */}
         {editing ? null : (
           <>
+            {/* Where the key comes from, and which boxes to tick when making it:
+                too few and the library reads half-blind, too many and this app is
+                handed write powers it has no code for (see the permission table in
+                `docker/md/immich-library-plan.md`). The door's own question — a
+                server already saved answered it when its key was made. */}
+            <p className="hint" data-key="immich-keyhelp">
+              {t('lib.immich.keyHelp')}
+            </p>
             <label className="hint">
               <input
                 type="checkbox"