diff --git a/certbot/docs/cli-help.txt b/certbot/docs/cli-help.txt
index 053716b4b..fea6e4d0e 100644
--- a/certbot/docs/cli-help.txt
+++ b/certbot/docs/cli-help.txt
@@ -716,7 +716,8 @@ manual:
   resource requested when performing an HTTP-01 challenge. An additional
   cleanup script can also be provided and can use the additional variable
   $CERTBOT_AUTH_OUTPUT which contains the stdout output from the auth
-  script. For both authenticator and cleanup script, on HTTP-01 and DNS-01
+  script (truncated to 10 KB to avoid ARG_MAX limits in the cleanup hook).
+  For both authenticator and cleanup script, on HTTP-01 and DNS-01
   challenges, $CERTBOT_REMAINING_CHALLENGES will be equal to the number of
   challenges that remain after the current one, and $CERTBOT_ALL_IDENTIFIERS
   contains a comma-separated list of all identifiers that are challenged for
diff --git a/certbot/docs/using.rst b/certbot/docs/using.rst
index 9350b0f04..de7ecaea1 100644
--- a/certbot/docs/using.rst
+++ b/certbot/docs/using.rst
@@ -1094,7 +1094,7 @@ variables to these scripts:
 
 Additionally for cleanup:
 
-- ``CERTBOT_AUTH_OUTPUT``: Whatever the auth script wrote to stdout
+- ``CERTBOT_AUTH_OUTPUT``: Whatever the auth script wrote to stdout (truncated to 10 KB to avoid ARG_MAX limits)
 
 Certbot also sets ``CERTBOT_DOMAIN`` and ``CERTBOT_ALL_DOMAINS`` to the same values as
 ``CERTBOT_IDENTIFIER`` and ``CERTBOT_ALL_IDENTIFIERS`` respectively for backwards compatibility,