diff --git a/k8s/charts/seaweedfs/values.yaml b/k8s/charts/seaweedfs/values.yaml
index 5b1b5ece04..51df7ca9a8 100644
--- a/k8s/charts/seaweedfs/values.yaml
+++ b/k8s/charts/seaweedfs/values.yaml
@@ -1744,6 +1744,14 @@ worker:
 
   # The lance_* jobs run in their own container, /usr/bin/weed-worker.
   # amd64/arm64 only; pin mixed clusters with worker.affinity/nodeSelector.
+  # It keeps tables through the filers the masters list and reads
+  # security.toml. The Lance namespace knows it by a token derived from
+  # jwt.filer_signing.key, which the chart renders only with
+  # global.seaweedfs.securityConfig.jwtSigning.filerWrite: true. When S3 has
+  # identities, set it, or the namespace lists the worker no tables and the
+  # lance_* jobs find nothing to do. It also makes the filer accept only signed
+  # HTTP writes, so clients writing to the filer's HTTP API directly need a JWT
+  # signed with that key.
 
   # Lance namespace URL override; empty derives it from s3.lancePort.
   namespaceUrl: ""