diff --git a/admin_manual/configuration_user/user_auth_ldap.rst b/admin_manual/configuration_user/user_auth_ldap.rst
index 057b39f2aa6..d6515e0ea2f 100644
--- a/admin_manual/configuration_user/user_auth_ldap.rst
+++ b/admin_manual/configuration_user/user_auth_ldap.rst
@@ -392,6 +392,21 @@ Group Member association:
 
   * Example: *uniquemember*
 
+.. warning::
+   Matching a user's ``gidNumber`` to a group's ``gidNumber`` also makes
+   Nextcloud treat that user as a member of the group. This is the POSIX
+   primary-group mechanism. It applies **in addition to** (and independently
+   of) whatever you configure here — for example ``member``, ``memberUid``,
+   or ``uniqueMember``.
+
+   So after you remove a user from an LDAP group via the usual membership
+   attribute, they may still appear as a member in the web UI and in
+   ``occ`` output while their ``gidNumber`` still matches the group's. The
+   same idea applies to Active Directory ``primaryGroupID``. The attribute
+   name used for the user-side value is configurable as ``ldapGidNumber``
+   (default ``gidNumber``) via the LDAP configuration API / ``occ``, but it
+   is not exposed in the admin UI.
+
 Nested groups:
   Enable group member retrieval from sub groups.