diff --git a/docs/index.md b/docs/index.md
index d2ac314d..510a6792 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -155,9 +155,9 @@ provider "proxmox" {
 }
 ```
 
--> **Note:** The `username` field in the `ssh` block is required when using API Token authentication. This is because the provider needs to know which user to use for the SSH connection.
+-> **Note:** Note1: The `username` field in the `ssh` block (or alternatively a username in `PROXMOX_VE_USERNAME` or `PROXMOX_VE_SSH_USERNAME` environment variable) is required when using API Token authentication. This is because the provider needs to know which user to use for the SSH connection.
 
--> **Note:** Not all Proxmox API operations are supported via API Token. You may see errors like `error creating container: received an HTTP 403 response - Reason: Permission check failed (changing feature flags for privileged container is only allowed for root@pam)` or `error creating VM: received an HTTP 500 response - Reason: only root can set 'arch' config` when using API Token authentication, even when `Administrator` role or the `root@pam` user is used with the token.
+-> **Note:** Note2: Not all Proxmox API operations are supported via API Token. You may see errors like `error creating container: received an HTTP 403 response - Reason: Permission check failed (changing feature flags for privileged container is only allowed for root@pam)` or `error creating VM: received an HTTP 500 response - Reason: only root can set 'arch' config` when using API Token authentication, even when `Administrator` role or the `root@pam` user is used with the token. The workaround is to use password authentication for those operations.
 
 ### Temporary directory
 
diff --git a/docs/resources/virtual_environment_container.md b/docs/resources/virtual_environment_container.md
index 7e50c4f0..b6b06a32 100644
--- a/docs/resources/virtual_environment_container.md
+++ b/docs/resources/virtual_environment_container.md
@@ -198,7 +198,7 @@ output "ubuntu_container_public_key" {
 - `unprivileged` - (Optional) Whether the container runs as unprivileged on
   the host (defaults to `false`).
 - `vm_id` - (Optional) The container identifier
-- `features` - (Optional) The container features
+- `features` - (Optional) The container feature flags. Changing flags (except nesting) is only allowed for `root@pam` authenticated user.
   - `nesting` - (Optional) Whether the container is nested (defaults
       to `false`)
   - `fuse` - (Optional) Whether the container supports FUSE mounts (defaults